September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-91164 Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. |
medium | 4.3 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-82165 Dell Command | Integration Suite for System Center, versions prior to 6.7.2, con... |
medium | 5.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-82163 Dell Command | Intel vPro Out of Band, versions prior to 4.7.2, contain an Incor... |
medium | 5.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-63329 Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. |
medium | 4.9 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-61744 InvenTree is an Open Source Inventory Management System. |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-29 |
| CVE-2026-61746 InvenTree is an Open Source Inventory Management System. |
medium | 5.3 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-61747 InvenTree is an Open Source Inventory Management System. |
medium | 4.3 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-61748 InvenTree is an Open Source Inventory Management System. |
medium | 4.3 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-61749 InvenTree is an Open Source Inventory Management System. |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-92382 An out-of-bounds write flaw was found in usbredir. |
medium | 4.1 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-69190 Graylog is a free and open log management platform. |
medium | 6.3 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-61612 CKAN MCP Server is a tool for querying CKAN open data portals. |
medium | 5.7 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-61745 InvenTree is an Open Source Inventory Management System. |
medium | 4.3 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-48974 HomeBox is a home inventory and organization system. |
medium | 5.4 | — | — | 2026-09-21 | 2026-09-29 |
| CVE-2026-77561 Tinyauth is an authentication and authorization server. |
medium | 5.3 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-63334 draw.io is a configurable diagramming and whiteboarding application. |
medium | 6.8 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-63373 draw.io is a configurable diagramming and whiteboarding application. |
medium | 4.2 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-62866 Dasel is a command-line tool and library for querying, modifying, and transformi... |
medium | 6.2 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-62987 Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. |
medium | 5.8 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-58504 draw.io is a configurable diagramming and whiteboarding application. |
medium | 6.1 | — | — | 2026-09-21 | 2026-09-29 |
| CVE-2026-59168 Dasel is a command-line tool and library for querying, modifying, and transformi... |
medium | 6.2 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-62370 KubeEdge is an open source system for extending native containerized application... |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-29 |
| CVE-2026-17050 The experimental USB host stack allocates a per-device configuration-descriptor... |
medium | 5.7 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-17051 The Intel SEDI IPM (inter-processor mailbox) driver in drivers/ipm/ipm_sedi.c ha... |
medium | 6.0 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-88978 Hatchet is a platform for orchestrating background tasks, AI agents, and durable... |
medium | 4.3 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-77165 File owners were unable to unlock TYPE_TOKEN locks placed by other users, leavin... |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-63342 Hatchet is a platform for orchestrating background tasks, AI agents, and durable... |
medium | 6.3 | — | — | 2026-09-21 | 2026-09-29 |
| CVE-2026-61681 Hatchet is a platform for orchestrating background tasks, AI agents, and durable... |
medium | 4.1 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-36471 Deserialization of Untrusted Data of the __post_data parameter in cn_parse_url()... |
medium | 5.8 | — | — | 2026-09-21 | 2026-09-25 |
| CVE-2026-36472 CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS). |
medium | 5.2 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-36468 Cross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 allows remote unauth... |
medium | 6.1 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-36470 CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS) in index.php. |
medium | 5.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94184 A stack-based buffer overflow flaw was found in fetchmail when built with NTLM s... |
medium | 5.3 | — | — | 2026-09-21 | 2026-10-21 |
| CVE-2026-93339 Metaphor Creations Ditty (ditty-news-ticker) before 3.1.70 contains a stored cro... |
medium | 5.4 | — | — | 2026-09-21 | 2026-09-25 |
| CVE-2026-82355 When a request to the Airflow core API carries both a session cookie and an expl... |
medium | 4.2 | — | Apache / airflow | 2026-09-21 | 2026-09-25 |
| CVE-2026-75158 Apache Airflow's `/assets/events` API returned asset events for every Dag in the... |
medium | 4.3 | — | Apache / airflow | 2026-09-21 | 2026-09-25 |
| CVE-2026-61630 nginx ignition is a user interface for the nginx web server. |
medium | 4.2 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-55625 GoCD is a continuous deliver server. |
medium | 4.9 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-52743 GoCD is a continuous deliver server. |
medium | 4.3 | — | — | 2026-09-21 | 2026-09-25 |
| CVE-2026-94382 Beszel before 0.19.0 contains an insecure direct object reference vulnerability... |
medium | 4.2 | — | — | 2026-09-21 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.