September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-96259 Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10... |
medium | 5.5 | — | Mattermost / mattermost server | 2026-09-22 | 2026-10-07 |
| CVE-2026-88020 Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input d... |
medium | 6.1 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-77425 Unleash is an open-source feature management platform. |
medium | 4.3 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-77912 A stored cross-site scripting (XSS) vulnerability was identified in GitHub Enter... |
medium | 5.4 | — | Github / enterprise server | 2026-09-22 | 2026-10-02 |
| CVE-2026-75101 An authorization bypass vulnerability was identified in GitHub Enterprise Server... |
medium | 6.5 | — | Github / enterprise server | 2026-09-22 | 2026-10-02 |
| CVE-2026-88339 A NULL pointer dereference vulnerability exists in the gf_sg_vrml_field_clone()... |
medium | 5.5 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-88341 A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .y... |
medium | 5.5 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-88350 An integer overflow vulnerability exists in MPack 1.1.1 in mpack_node_cstr_alloc... |
medium | 6.2 | — | — | 2026-09-22 | 2026-10-01 |
| CVE-2026-83801 Nautobot is a Network Source of Truth and Network Automation Platform. |
medium | 5.4 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-83805 Nautobot is a Network Source of Truth and Network Automation Platform. |
medium | 6.4 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-79767 Gardener implements the automated management and operation of Kubernetes cluster... |
medium | 5.5 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-76716 Multiple vulnerabilities exist in the Analytics and Location Engine (ALE) that m... |
medium | 5.3 | — | Arubanetworks / analytics and location engine | 2026-09-22 | 2026-09-28 |
| CVE-2026-76717 A vulnerability exists in the Analytics and Location Engine (ALE) API that may a... |
medium | 5.3 | — | Arubanetworks / analytics and location engine | 2026-09-22 | 2026-09-28 |
| CVE-2026-65829 MPXJ is an open source library to read and write project plans from a variety of... |
medium | 5.3 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-75432 An issue in yaml-cpp 0.9.0 allows a remote attacker to obtain sensitive informat... |
medium | 5.1 | — | — | 2026-09-22 | 2026-10-03 |
| CVE-2026-91129 Home Assistant is open source home automation software focused on local control... |
medium | 5.4 | — | — | 2026-09-22 | 2026-09-25 |
| CVE-2026-89277 CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnera... |
medium | 5.5 | — | Adobe / c2pa | 2026-09-22 | 2026-10-15 |
| CVE-2026-84396 InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that co... |
medium | 5.5 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-77272 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
medium | 6.1 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-28 |
| CVE-2026-77399 icalendar is an RFC 5545 compatible parser and generator of iCalendar files for... |
medium | 6.5 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-77256 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
medium | 6.5 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-28 |
| CVE-2026-77257 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
medium | 6.5 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-77266 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
medium | 6.5 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-28 |
| CVE-2026-77268 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
medium | 5.5 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-77269 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
medium | 6.5 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-77249 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
medium | 5.3 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-77247 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
medium | 6.5 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-28 |
| CVE-2026-76192 InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that co... |
medium | 5.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-76194 CAI Content Credentials is affected by an Improper Input Validation vulnerabilit... |
medium | 4.3 | — | Adobe / c2pa | 2026-09-22 | 2026-10-15 |
| CVE-2026-75638 CAI Content Credentials is affected by an Improper Input Validation vulnerabilit... |
medium | 6.5 | — | Adobe / c2pa | 2026-09-22 | 2026-10-15 |
| CVE-2026-75656 Bridge is affected by an out-of-bounds read vulnerability that could lead to dis... |
medium | 5.5 | — | Adobe / bridge | 2026-09-22 | 2026-09-25 |
| CVE-2026-63386 js-toml is a TOML parser for JavaScript. |
medium | 5.3 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-75633 CAI Content Credentials is affected by an Improper Input Validation vulnerabilit... |
medium | 5.5 | — | Adobe / c2pa | 2026-09-22 | 2026-10-15 |
| CVE-2026-75634 CAI Content Credentials is affected by an Improper Input Validation vulnerabilit... |
medium | 4.3 | — | Adobe / c2pa | 2026-09-22 | 2026-10-15 |
| CVE-2026-37603 Improper Restriction of Excessive Authentication Attempts in the administration... |
medium | 6.5 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-37604 pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 resolves the clien... |
medium | 6.5 | — | — | 2026-09-22 | 2026-10-05 |
| CVE-2026-48361 Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability t... |
medium | 6.1 | — | Adobe / connect | 2026-09-22 | 2026-09-25 |
| CVE-2026-95660 A security flaw has been discovered in Moonshot AI Kimi Code up to 0.31.0. |
medium | 6.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95624 The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolea... |
medium | 6.8 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-86056 Notepad++ is a free and open-source source code editor. |
medium | 5.5 | — | — | 2026-09-22 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.