September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-77607 Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-63405 AnyCable is a realtime server for reliable two-way communication that supports a... |
medium | 5.9 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-63406 AnyCable is a realtime server for reliable two-way communication that supports a... |
medium | 5.9 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-61794 Capsule is a multi-tenancy and policy-based framework for Kubernetes. |
medium | 6.8 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-61795 Capsule is a multi-tenancy and policy-based framework for Kubernetes. |
medium | 6.8 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-93736 Mealie before 3.21.0 fails to validate user ownership in the ratings and favorit... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93737 Azkaban through 4.0.0 omits project permission checks in the ScheduleServlet fet... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93689 WinFsp through 2.2.26215 contains a null pointer dereference vulnerability in th... |
medium | 5.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-86689 Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read ac... |
medium | 5.9 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-93531 A weakness has been identified in gedelumbung HospitalManagement up to c2d455437... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-93532 A security vulnerability has been detected in gedelumbung HospitalManagement up... |
medium | 6.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-84450 libheif is a HEIF and AVIF file format decoder and encoder. |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-84451 libheif is a HEIF and AVIF file format decoder and encoder. |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-84448 libheif is a HEIF and AVIF file format decoder and encoder. |
medium | 4.0 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-81945 PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions bef... |
medium | 6.6 | — | — | 2026-09-18 | 2026-09-26 |
| CVE-2026-81946 PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions bef... |
medium | 4.4 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-81305 CM2507 IP cameras automatically execute a predetermined script from removable me... |
medium | 6.8 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-81943 PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions bef... |
medium | 6.7 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-75883 The code in pppd that formats a response to a PEAP Request packet in peap_respon... |
medium | 6.8 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-77960 Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read ac... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-63635 OpenImageIO is a toolset for reading, writing, and manipulating image files of a... |
medium | 5.5 | — | Openimageio / openimageio | 2026-09-18 | 2026-09-29 |
| CVE-2026-65969 OpenImageIO is a toolset for reading, writing, and manipulating image files of a... |
medium | 5.5 | — | Openimageio / openimageio | 2026-09-18 | 2026-09-29 |
| CVE-2026-65970 OpenImageIO is a toolset for reading, writing, and manipulating image files of a... |
medium | 5.3 | — | Openimageio / openimageio | 2026-09-18 | 2026-09-29 |
| CVE-2026-59181 OpenImageIO is a toolset for reading, writing, and manipulating image files of a... |
medium | 6.1 | — | Openimageio / openimageio | 2026-09-18 | 2026-09-29 |
| CVE-2026-59956 OpenImageIO is a toolset for reading, writing, and manipulating image files of a... |
medium | 6.1 | — | Openimageio / openimageio | 2026-09-18 | 2026-09-29 |
| CVE-2026-63420 OpenImageIO is a toolset for reading, writing, and manipulating image files of a... |
medium | 5.5 | — | Openimageio / openimageio | 2026-09-18 | 2026-09-29 |
| CVE-2026-1025 IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-1029 IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0... |
medium | 5.4 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-1030 IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-1031 IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-1037 IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-54147 http4k is a functional toolkit for Kotlin HTTP applications. |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-59156 OpenImageIO is a toolset for reading, writing, and manipulating image files of a... |
medium | 6.5 | — | Openimageio / openimageio | 2026-09-18 | 2026-09-29 |
| CVE-2026-10841 IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Serv... |
medium | 4.8 | — | — | 2026-09-18 | 2026-10-22 |
| CVE-2026-11537 IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to o... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2025-36147 IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4.0... |
medium | 6.1 | — | — | 2026-09-18 | 2026-10-14 |
| CVE-2025-36178 IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could al... |
medium | 5.4 | — | — | 2026-09-18 | 2026-10-14 |
| CVE-2025-36421 IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 transmit... |
medium | 5.9 | — | — | 2026-09-18 | 2026-10-14 |
| CVE-2025-33141 IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 006 could allow an authenticated... |
medium | 6.5 | — | — | 2026-09-18 | 2026-10-14 |
| CVE-2025-33147 IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 co... |
medium | 5.9 | — | — | 2026-09-18 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.