September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100802 Uninitialized memory in the Graphics: WebGPU component. |
medium | 4.3 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100806 Uninitialized memory in the Graphics: WebGPU component. |
medium | 4.3 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100793 JIT miscompilation in the JavaScript Engine component. |
medium | 6.5 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100795 Denial-of-service in the Networking component. |
medium | 6.5 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100799 Uninitialized memory in the Graphics: WebGPU component. |
medium | 4.3 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100783 Uninitialized memory in the Audio/Video component. |
medium | 4.3 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100766 Information disclosure in the Networking: JAR component. |
medium | 4.3 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-73593 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
medium | 6.7 | — | Dell / policy manager for secure connect gateway | 2026-09-29 | 2026-10-15 |
| CVE-2026-73596 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
medium | 6.5 | — | Dell / policy manager for secure connect gateway | 2026-09-29 | 2026-10-15 |
| CVE-2026-66083 The /datasources/unauth-datasource endpoint does not properly enforce data sourc... |
medium | 6.5 | — | Apache / dolphinscheduler | 2026-09-29 | 2026-10-06 |
| CVE-2026-102507 Sliver C2 framework version 1.7.7 and earlier contains an unhandled panic vulner... |
medium | 5.7 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-96422 Frame protocol metadissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows... |
medium | 5.5 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-06 |
| CVE-2026-96415 Catapult DCT2000 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18... |
medium | 5.5 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-96416 IEEE 802.11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allow... |
medium | 5.5 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-96417 RF4CE protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows deni... |
medium | 5.5 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-96418 TIFF protocol dissector infinite loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allo... |
medium | 5.5 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-96420 Toshiba file parser crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of... |
medium | 5.5 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-06 |
| CVE-2026-96421 USB HID protocol dissector infinite loop and memory leak in 4.6.0 to 4.6.8 and 4... |
medium | 5.5 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-06 |
| CVE-2026-95390 PEAK CAN TRC file parser crash in 4.6.0 to 4.6.8 allows denial of service |
medium | 5.5 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-95391 ZigBee ZCL protocol dissector crash in 4.6.0 to 4.6.8 allows denial of service |
medium | 5.5 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-95392 MBIM protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denia... |
medium | 5.5 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-95393 CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows deni... |
medium | 4.7 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-95394 Microsoft Network Monitor file parser large loop in 4.6.0 to 4.6.8 and 4.4.0 to... |
medium | 4.7 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-95395 IEEE C37.118 Synchrophasor protocol dissector memory leak in 4.6.0 to 4.6.8 and... |
medium | 5.5 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-95386 TTL file parser infinite loop in 4.6.0 to 4.6.8 allows denial of service |
medium | 5.5 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-95388 Sharkd utility crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of serv... |
medium | 5.5 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-8067 An improper authorization vulnerability in the end-of-life versions of RTU500’s... |
medium | 6.5 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-8937 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0... |
medium | 4.3 | — | Gitlab / gitlab | 2026-09-29 | 2026-10-05 |
| CVE-2026-76720 A vulnerability in HPE OneView can be remotely exploited to cause a URL redirect... |
medium | 4.3 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-81862 Apache Airflow's Teradata provider embedded cloud storage credentials directly i... |
medium | 6.5 | — | Apache / apache-airflow-providers-teradata | 2026-09-29 | 2026-10-07 |
| CVE-2026-81914 Apache Airflow's Google provider built Google Drive search expressions by interp... |
medium | 4.3 | — | Apache / apache-airflow-providers-google | 2026-09-29 | 2026-10-07 |
| CVE-2026-81930 Apache Airflow's Snowflake provider did not validate the connection's `account`... |
medium | 6.3 | — | Apache / apache-airflow-providers-snowflake | 2026-09-29 | 2026-10-07 |
| CVE-2026-86843 The Apache Airflow Teradata provider's compute-cluster example Dag declared ever... |
medium | 6.3 | — | Apache / apache-airflow-providers-teradata | 2026-09-29 | 2026-10-07 |
| CVE-2026-102473 A flaw was found in dash. |
medium | 5.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102474 A flaw was found in dash. |
medium | 4.0 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-10518 GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 bef... |
medium | 4.3 | — | Gitlab / gitlab | 2026-09-29 | 2026-10-05 |
| CVE-2026-91085 Apache Karaf's shell/SSH command security is enforced by per-scope ACL configura... |
medium | 6.3 | — | Apache / karaf | 2026-09-29 | 2026-10-07 |
| CVE-2026-86157 Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere... |
medium | 5.6 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102292 A flaw has been found in coolbeans1212 MateisHomePage-Website up to ea2a4226deec... |
medium | 4.3 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102263 A vulnerability has been found in mwasikz robo-cafe-rms up to 228c44a02823f04e85... |
medium | 4.7 | — | — | 2026-09-29 | 2026-09-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.