September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-20280 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | Cisco / ios xr | 2026-09-02 | 2026-09-18 |
| CVE-2026-20281 A vulnerability in Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Se... |
high | 7.5 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-20275 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-18 |
| CVE-2026-20276 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.6 | — | Cisco / ios xr | 2026-09-02 | 2026-09-18 |
| CVE-2026-84837 A flaw was found in rpm. |
high | 7.8 | — | — | 2026-09-02 | 2026-10-14 |
| CVE-2026-84838 A flaw was found in rpmuncompress. |
high | 7.8 | — | — | 2026-09-02 | 2026-10-14 |
| CVE-2026-84675 OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier a... |
high | 7.4 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84665 Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes f... |
high | 8.0 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84667 Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's back... |
high | 7.1 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84668 Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAM... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84669 A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allow... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84670 Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict th... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84671 Jenkins File Parameter Plugin 425.v3fa_801681b_5e and earlier allows writing fil... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84672 Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9cc2d2 and e... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84673 Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overw... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84645 In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked a... |
high | 8.8 | — | Jenkins / jenkins | 2026-09-02 | 2026-09-11 |
| CVE-2026-84647 In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, inc... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84648 In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer doe... |
high | 8.8 | — | Jenkins / jenkins | 2026-09-02 | 2026-09-11 |
| CVE-2026-84649 In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), e... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84650 In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot b... |
high | 8.8 | — | Jenkins / jenkins | 2026-09-02 | 2026-09-11 |
| CVE-2026-84652 In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate t... |
high | 7.3 | — | Jenkins / jenkins | 2026-09-02 | 2026-09-11 |
| CVE-2026-78689 Description
NGINX JavaScript (njs) has a vulnerability in the XML module's name... |
high | 8.1 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-77180 When NGINX Ingress Controller is configured with Ingress annotations, an injecti... |
high | 8.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-78222 A vulnerability exists in NGINX JavaScript where a malformed HTTP response recei... |
high | 7.5 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-78408 The nsenter --join-cgroup option opens the target cgroup.procs file as root and... |
high | 7.9 | — | — | 2026-09-02 | 2026-10-30 |
| CVE-2026-78409 The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later... |
high | 7.0 | — | — | 2026-09-02 | 2026-10-21 |
| CVE-2026-78410 A flaw was found in util-linux. |
high | 7.8 | — | — | 2026-09-02 | 2026-10-30 |
| CVE-2026-66362 Description:
When NGINX Plus is configured as the data plane for NGINX Gateway F... |
high | 8.1 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-66842 BIG-IP has a vulnerability where an authenticated user of any role may be able t... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-14199 Only self-managed Grafana instances with Auth Proxy authentication and identity... |
high | 8.1 | — | Grafana / grafana | 2026-09-02 | 2026-09-15 |
| CVE-2026-18058 The mobile Smart Connect dashboard UI was subject to manipulation
by 3rd party a... |
high | 7.5 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-18329 Description
NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerabili... |
high | 8.2 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-78604 Incorrect Permission Assignment for Critical Resource (CWE-732) in Elastic Agent... |
high | 7.8 | — | Elastic / elastic agent | 2026-09-02 | 2026-09-04 |
| CVE-2026-78590 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (... |
high | 7.3 | — | Elastic / kibana | 2026-09-02 | 2026-09-03 |
| CVE-2025-15485 The Auto x LINE WordPress plugin through 1.0.0 does not have authorization check... |
high | 8.2 | — | — | 2026-09-02 | 2026-10-19 |
| CVE-2026-76759 Vulnerability in Drupal Screenshot. |
high | 7.3 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-76782 Vulnerability in Drupal Screenshot. |
high | 7.3 | — | — | 2026-09-02 | 2026-10-05 |
| CVE-2026-84796 Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in G... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84798 Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 fail to perform an independent aut... |
high | 7.1 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84800 Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing authorization vu... |
high | 7.1 | — | — | 2026-09-02 | 2026-09-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.