September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-102623 A flaw was found in KubeVirt. |
medium | 6.5 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102633 libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability... |
medium | 5.9 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-101126 Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4... |
medium | 6.5 | — | Balbooa / forms | 2026-09-29 | 2026-10-06 |
| CVE-2026-101112 Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa... |
medium | 5.3 | — | Balbooa / forms | 2026-09-29 | 2026-10-06 |
| CVE-2026-100243 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site... |
medium | 6.1 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-100245 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site... |
medium | 6.1 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-100238 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site... |
medium | 6.1 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-97688 urllib3 is an HTTP client library for Python. |
medium | 5.3 | — | Python / urllib3 | 2026-09-29 | 2026-10-13 |
| CVE-2026-93330 Improper rule enforcement in the PAM Active Directory provider in Devolutions Se... |
medium | 4.3 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-93332 Improper access control in the partial connection API in Devolutions Server 2026... |
medium | 5.4 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-75805 Issue summary: A CMP client that requests certificate revocation on the basis
of... |
medium | 5.3 | — | Openssl / openssl | 2026-09-29 | 2026-10-08 |
| CVE-2026-75806 Issue summary: An established DTLS 1.2 association using an AEAD cipher suite
ca... |
medium | 5.3 | — | Openssl / openssl | 2026-09-29 | 2026-10-08 |
| CVE-2026-75804 Issue summary: OpenSSL QUIC stack does not enforce connection
level flow control... |
medium | 5.3 | — | Openssl / openssl | 2026-09-29 | 2026-10-08 |
| CVE-2026-35189 Issue summary: A certificate with many nameRelativeToCRLIssuer CRL
distribution... |
medium | 5.3 | — | Openssl / openssl | 2026-09-29 | 2026-10-08 |
| CVE-2026-42772 Issue summary: The QUIC stream reassembly algorithm performance deteriorates
pro... |
medium | 5.3 | — | Openssl / openssl | 2026-09-29 | 2026-10-08 |
| CVE-2026-102630 UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies a... |
medium | 4.7 | — | — | 2026-09-29 | 2026-10-02 |
| CVE-2026-100286 Missing authorization in the data source settings API in Devolutions Server 2026... |
medium | 6.5 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-100287 Missing authorization in the attachment history API in Devolutions Server 2026.3... |
medium | 5.4 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-100289 Missing authorization in the gateway network scan token API in Devolutions Serve... |
medium | 5.0 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102567 CTranslate2 before 4.8.1 contains an out-of-bounds heap read vulnerability in th... |
medium | 6.1 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102568 Pardus Parental Control before 0.7.0 contains an incorrect authorization vulnera... |
medium | 5.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102569 ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulne... |
medium | 5.5 | — | — | 2026-09-29 | 2026-10-02 |
| CVE-2026-102570 ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulne... |
medium | 5.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2025-33207 NVIDIA ConnectX and Bluefield contain a vulnerability in a control register, whe... |
medium | 6.8 | — | — | 2026-09-29 | 2026-10-14 |
| CVE-2026-71898 An incorrect authorization check in Apache DolphinScheduler allows an authentica... |
medium | 4.3 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-71899 A missing authorization vulnerability exists in the `query-dynamic-sub-workflows... |
medium | 6.5 | — | — | 2026-09-29 | 2026-10-01 |
| CVE-2026-78214 An authentication bypass vulnerability exists in the protection of Actuator endp... |
medium | 5.3 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-81569 An improper authorization vulnerability exists in the handling of sub-workflow t... |
medium | 4.3 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-71897 An improper authorization check in Apache DolphinScheduler allows an authenticat... |
medium | 4.3 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-96869 Information disclosure in the Networking component. |
medium | 4.3 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-98164 In the Linux kernel, the following vulnerability has been resolved:
KVM: x86/mm... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-29 | 2026-10-07 |
| CVE-2026-76114 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
medium | 5.9 | — | Dell / policy manager for secure connect gateway | 2026-09-29 | 2026-10-06 |
| CVE-2026-76875 PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability... |
medium | 5.3 | — | — | 2026-09-29 | 2026-10-02 |
| CVE-2026-73599 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
medium | 5.4 | — | Dell / policy manager for secure connect gateway | 2026-09-29 | 2026-10-06 |
| CVE-2026-100821 Site isolation issue in the Panning and Zooming component. |
medium | 4.7 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100822 Spoofing issue in the Networking: HTTP component. |
medium | 5.4 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100823 Spoofing issue in the Downloads component in Firefox for Android. |
medium | 5.4 | — | Mozilla / firefox mobile | 2026-09-29 | 2026-10-05 |
| CVE-2026-100826 Denial-of-service in the Storage: StorageManager component. |
medium | 6.5 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100812 Denial-of-service in the Graphics component. |
medium | 6.5 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100817 Other issue in the JavaScript: WebAssembly component. |
medium | 5.4 | — | Mozilla / firefox | 2026-09-29 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.