September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-73767 Authenticated command injection vulnerabilities exist in the command line interf... |
high | 7.2 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73768 A vulnerability exists in the command line interface of AOS-CX that may allow fo... |
high | 7.3 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73770 An authenticated arbitrary file write vulnerability exists in AOS-CX. |
high | 7.3 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73771 An authentication vulnerability exists in the AOS-CX management interface and AP... |
high | 7.5 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73750 Vulnerabilities exist in the authentication module that may improperly process m... |
high | 8.8 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-22 |
| CVE-2026-73751 An authenticated user with low-privileged access could submit crafted input thro... |
high | 8.8 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-22 |
| CVE-2026-73752 An unauthenticated arbitrary file write vulnerability exists in an API endpoint... |
high | 8.8 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-22 |
| CVE-2026-73753 Exploitation through affected command-line operations could allow an authenticat... |
high | 8.8 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-22 |
| CVE-2026-71981 Cypht before 2.12.2 contains a PHP object injection vulnerability that allows au... |
high | 8.8 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-78607 Missing Authorization (CWE-862) in the Elasticsearch custom inference service ca... |
high | 7.1 | — | Elastic / elasticsearch | 2026-09-01 | 2026-09-02 |
| CVE-2026-78592 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (... |
high | 7.3 | — | Elastic / kibana | 2026-09-01 | 2026-09-02 |
| CVE-2026-73725 A local privilege-escalation vulnerability has been discovered in HPE Networking... |
high | 7.0 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73716 A remote code execution vulnerability exists in the underlying operating system... |
high | 7.5 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73717 A command injection vulnerability exists in the web-based management interface o... |
high | 7.5 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73718 A vulnerability in the web-based management interface of HPE Networking Fabric C... |
high | 7.4 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73719 An arbitrary file write vulnerability exists in the API of HPE Networking Fabric... |
high | 7.2 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73720 Insecure file operations in the API of HPE Networking Fabric Composer could allo... |
high | 7.2 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73721 Vulnerabilities in the API of HPE Networking Fabric Composer could allow an auth... |
high | 7.2 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73722 Command injection vulnerabilities in the web-based management interface of HPE N... |
high | 7.2 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73723 A privilege escalation vulnerability exists in the web-based management interfac... |
high | 7.1 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73724 Privilege escalation vulnerabilities exist in the API of HPE Networking Fabric C... |
high | 7.1 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73707 Privilege escalation vulnerabilities exist in the API of HPE Networking Fabric C... |
high | 8.5 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73708 A business logic vulnerability exists in the API of HPE Networking Fabric Compos... |
high | 8.3 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73709 A vulnerability in the underlying operating system of HPE Networking Fabric Comp... |
high | 8.3 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73710 Vulnerabilities in an API endpoint of HPE Networking Fabric Composer could allow... |
high | 8.2 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73711 A privilege escalation vulnerability exists in the API endpoint of HPE Networkin... |
high | 8.1 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73712 A vulnerability in the API of HPE Networking Fabric Composer could allow an unau... |
high | 8.1 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-03 |
| CVE-2026-73713 Local privilege-escalation vulnerabilities have been discovered in HPE Networkin... |
high | 7.8 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73714 A sensitive information disclosure vulnerability exists in the API of HPE Networ... |
high | 7.6 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73715 A vulnerability in the API of HPE Networking Fabric Composer could allow an unau... |
high | 7.5 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73702 A privilege escalation vulnerability exists in the API of HPE Networking Fabric... |
high | 8.8 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73703 A vulnerability in the web-based management interface of HPE Networking Fabric C... |
high | 8.8 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73704 A command sanitization bypass exists in the API of HPE Networking Fabric Compose... |
high | 8.8 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73705 An arbitrary file write vulnerability in the API of HPE Networking Fabric Compos... |
high | 8.8 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73706 A vulnerability in the API of HPE Networking Fabric Composer could allow an unau... |
high | 8.6 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-72649 Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learnin... |
high | 8.8 | — | Elastic / elasticsearch | 2026-09-01 | 2026-09-02 |
| CVE-2026-63137 Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via... |
high | 8.3 | — | Elastic / kibana | 2026-09-01 | 2026-09-02 |
| CVE-2026-45221 Konga before 2.1.0 contains a privilege escalation vulnerability that allows low... |
high | 7.8 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-8712 Wyoming before 1.10.2 contains a server-side request forgery vulnerability that... |
high | 8.3 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83551 Cleartext storage of sensitive information in the @step and @remote decorator pi... |
high | 7.2 | — | — | 2026-09-01 | 2026-09-03 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.