September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-47531 NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the... |
medium | 4.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-47532 NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the... |
medium | 6.7 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-47522 NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the... |
medium | 6.7 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-47524 NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the... |
medium | 6.7 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-47525 NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the... |
medium | 6.7 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-47515 NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the... |
medium | 6.7 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-47517 NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode... |
medium | 5.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-47518 NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in a se... |
medium | 6.0 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-47509 NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the... |
medium | 6.7 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-47506 NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel-mod... |
medium | 5.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-47492 NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the... |
medium | 5.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-100275 In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notif... |
medium | 4.8 | — | Jetbrains / youtrack | 2026-09-30 | 2026-10-02 |
| CVE-2026-100278 In JetBrains YouTrack before 2026.2.19197 users with restricted permission could... |
medium | 4.9 | — | Jetbrains / youtrack | 2026-09-30 | 2026-10-02 |
| CVE-2026-100279 In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed it... |
medium | 6.5 | — | Jetbrains / youtrack | 2026-09-30 | 2026-10-02 |
| CVE-2026-100280 In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable... |
medium | 4.3 | — | Jetbrains / youtrack | 2026-09-30 | 2026-10-02 |
| CVE-2026-100269 In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporter... |
medium | 4.3 | — | Jetbrains / youtrack | 2026-09-30 | 2026-10-01 |
| CVE-2026-100272 In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notificat... |
medium | 4.9 | — | Jetbrains / youtrack | 2026-09-30 | 2026-10-02 |
| CVE-2026-100274 In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a... |
medium | 6.5 | — | Jetbrains / youtrack | 2026-09-30 | 2026-10-02 |
| CVE-2026-100263 In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Age... |
medium | 6.1 | — | Jetbrains / youtrack | 2026-09-30 | 2026-10-02 |
| CVE-2026-100265 In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party sk... |
medium | 6.5 | — | Jetbrains / rider | 2026-09-30 | 2026-10-02 |
| CVE-2026-100266 In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated... |
medium | 6.5 | — | Jetbrains / hub | 2026-09-30 | 2026-10-02 |
| CVE-2026-100267 In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox... |
medium | 5.9 | — | Jetbrains / youtrack | 2026-09-30 | 2026-10-01 |
| CVE-2026-100257 In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was po... |
medium | 4.3 | — | Jetbrains / youtrack | 2026-09-30 | 2026-10-02 |
| CVE-2026-100258 In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-onl... |
medium | 4.3 | — | Jetbrains / youtrack | 2026-09-30 | 2026-10-02 |
| CVE-2026-100259 In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart... |
medium | 4.3 | — | Jetbrains / youtrack | 2026-09-30 | 2026-10-02 |
| CVE-2026-100260 In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentica... |
medium | 5.3 | — | Jetbrains / youtrack | 2026-09-30 | 2026-10-02 |
| CVE-2026-100261 In JetBrains YouTrack before 2026.2.18991 changing article visibility settings w... |
medium | 5.4 | — | Jetbrains / youtrack | 2026-09-30 | 2026-10-02 |
| CVE-2026-62084 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103396 bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMidd... |
medium | 4.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103397 OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requ... |
medium | 5.6 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-103227 A weakness has been identified in GPAC up to 26.07.0. |
medium | 6.3 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-103243 LightLLM through 1.2.0 fails to validate image_url and audio_url parameters in m... |
medium | 5.8 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-103222 A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. |
medium | 5.6 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103226 A vulnerability was identified in Artifex Ghostscript up to 10.07.0. |
medium | 6.3 | — | — | 2026-09-30 | 2026-10-15 |
| CVE-2026-103118 A vulnerability was detected in GraphicsMagick up to 1.3.47. |
medium | 4.3 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-97302 Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions. |
medium | 5.3 | — | — | 2026-09-30 | 2026-10-12 |
| CVE-2026-97288 Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions. |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97292 Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2.15.0 vers... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97298 Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 v... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97299 Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment Links for... |
medium | 5.4 | — | — | 2026-09-30 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.