September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-61754 NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a... |
high | 7.8 | — | Nvidia / nemo megatron bridge | 2026-09-01 | 2026-09-02 |
| CVE-2026-61755 NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a... |
high | 7.8 | — | Nvidia / nemo megatron bridge | 2026-09-01 | 2026-09-02 |
| CVE-2026-61756 NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a... |
high | 7.8 | — | Nvidia / nemo megatron bridge | 2026-09-01 | 2026-09-02 |
| CVE-2026-61757 NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a... |
high | 7.8 | — | Nvidia / nemo megatron bridge | 2026-09-01 | 2026-09-02 |
| CVE-2026-61758 NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a... |
high | 7.8 | — | Nvidia / nemo megatron bridge | 2026-09-01 | 2026-09-02 |
| CVE-2026-61759 NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a... |
high | 7.8 | — | Nvidia / nemo megatron bridge | 2026-09-01 | 2026-09-02 |
| CVE-2026-61750 NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a... |
high | 7.8 | — | Nvidia / nemo megatron bridge | 2026-09-01 | 2026-09-02 |
| CVE-2026-58567 Dell PowerStore contains an OS Command Injection vulnerability. |
high | 8.8 | — | Dell / powerstoreos | 2026-09-01 | 2026-10-02 |
| CVE-2026-51768 Incorrect access control in the setElinkQosConfig function of TOTOLINK T6 4.1.5c... |
high | 7.5 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-49329 A flaw was found in openshift/oauth-server. |
high | 7.5 | — | — | 2026-09-01 | 2026-10-30 |
| CVE-2026-10195 The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in ver... |
high | 8.8 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-84233 A flaw was found in rpm. |
high | 7.0 | — | — | 2026-09-01 | 2026-10-02 |
| CVE-2026-84111 A flaw has been found in Chanjet CRM up to 20260707. |
high | 7.3 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-84115 A vulnerability was found in Cleo Harmony up to 5.8.1.10. |
high | 8.3 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-79686 Dell PowerStore contains a Protection Mechanism Failure vulnerability. |
high | 8.8 | — | Dell / powerstoreos | 2026-09-01 | 2026-10-02 |
| CVE-2026-58569 Dell PowerStore contains an Inclusion of Functionality from Untrusted Control Sp... |
high | 8.8 | — | Dell / powerstoreos | 2026-09-01 | 2026-10-02 |
| CVE-2026-18771 Missing authentication for critical function vulnerability in TMT Machine Indust... |
high | 7.5 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-18780 Cross-Site request forgery (CSRF) vulnerability in TMT Machine Industry and Trad... |
high | 7.1 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-18630 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
high | 8.8 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-84218 A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient val... |
high | 8.1 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-79684 Dell PowerStore contains a Protection Mechanism Failure vulnerability. |
high | 8.8 | — | Dell / powerstoreos | 2026-09-01 | 2026-10-02 |
| CVE-2026-80047 A vulnerability in Hugging Face Transformers (versions 4.57.0 to 5.16.1) allows... |
high | 7.8 | — | — | 2026-09-01 | 2026-09-23 |
| CVE-2026-51766 Incorrect access control in the setDevReboot function of TOTOLINK T6 4.1.5cu.748... |
high | 7.5 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-58571 Dell PowerStore contains an OS Command Injection vulnerability. |
high | 8.8 | — | Dell / powerstoreos | 2026-09-01 | 2026-10-02 |
| CVE-2026-58572 Dell PowerStore contains a Code Injection vulnerability. |
high | 8.8 | — | Dell / powerstoreos | 2026-09-01 | 2026-10-02 |
| CVE-2026-19513 The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in... |
high | 8.1 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2024-14047 A local vulnerability in the Winlogbeat Windows installer caused runtime files t... |
high | 7.1 | — | Elastic / winlogbeat | 2026-09-01 | 2026-10-27 |
| CVE-2026-84144 Internally found bugs present in Thunderbird 154 and Thunderbird ESR 153.1. |
high | 7.5 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84145 Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thun... |
high | 7.5 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84130 Information disclosure in the Graphics: WebGPU component. |
high | 7.5 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84131 Privilege escalation due to invalid pointer in the Graphics component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84132 Information disclosure in the Networking: HTTP component. |
high | 7.5 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84123 Privilege escalation due to use-after-free in the Graphics: WebGPU component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-01 | 2026-09-02 |
| CVE-2026-84128 Privilege escalation in the WebDriver BiDi component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84117 Privilege escalation in Firefox for Android. |
high | 8.8 | — | Mozilla / firefox mobile | 2026-09-01 | 2026-09-03 |
| CVE-2026-79683 Dell PowerStore contains a Protection Mechanism Failure vulnerability. |
high | 8.8 | — | Dell / powerstoreos | 2026-09-01 | 2026-09-30 |
| CVE-2026-58575 Dell PowerStore contains an Authentication Bypass by Spoofing vulnerability. |
high | 8.8 | — | Dell / powerstoreos | 2026-09-01 | 2026-09-30 |
| CVE-2026-84195 Kyverno before 1.16.4 automatically attaches the admission controller's ServiceA... |
high | 7.7 | — | — | 2026-09-01 | 2026-09-10 |
| CVE-2026-84196 Kyverno before 1.18.0 contains a server-side request forgery vulnerability in ap... |
high | 7.7 | — | — | 2026-09-01 | 2026-09-10 |
| CVE-2026-84199 Kyverno before 1.16.2 contains a server-side request forgery (SSRF) vulnerabilit... |
high | 7.7 | — | — | 2026-09-01 | 2026-10-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.