September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-76444 A vulnerability in an internal service of Cisco ISE and Cisco ISE-PIC could allo... |
medium | 5.3 | — | Cisco / identity services engine passive identity connector | 2026-09-16 | 2026-09-28 |
| CVE-2026-76433 A vulnerability in the client provisioning download feature of Cisco ISE and Cis... |
medium | 5.3 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-76434 A vulnerability in the certificate import functionality of the web-based managem... |
medium | 4.9 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-76438 A vulnerability in the web-based management interface of Cisco BroadWorks CommPi... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-76426 A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an au... |
medium | 4.9 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-76427 A vulnerability in the offline profiler feed service of Cisco ISE could allow an... |
medium | 4.9 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-76428 A vulnerability in the REST APIs of Cisco ISE and Cisco ISE-PIC could allow an a... |
medium | 4.9 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-76431 A vulnerability in the file management function of the web-based management inte... |
medium | 4.9 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-76432 A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE... |
medium | 4.9 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-20350 A vulnerability in the web-based management interface of Cisco ThousandEyes Virt... |
medium | 4.7 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20309 A vulnerability in the web-based management interface of Cisco Identity Services... |
medium | 6.1 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20285 A vulnerability in the web-based management interface of Cisco Identity Services... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20286 A vulnerability in the web-based management interface of Cisco Identify Services... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20287 As part of Cisco's ongoing commitment to proactive security and product quality,... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20290 A vulnerability in SSL/TLS certificate parsing in the Snort 2 Detection Engine o... |
medium | 5.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20235 A vulnerability in the API of Cisco Identity Services Engine (ISE) could allow a... |
medium | 4.9 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-20248 A vulnerability in the DNS over TCP implementation of Cisco Secure Firewall Adap... |
medium | 6.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20282 A vulnerability in Cisco ISE could allow an authenticated, remote attacker to ob... |
medium | 4.9 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-20283 A vulnerability in the IPsec Open API endpoint of Cisco ISE could allow an authe... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20072 A vulnerability in the web-based management interface of Cisco ISE could allow a... |
medium | 4.9 | — | — | 2026-09-16 | 2026-09-19 |
| CVE-2026-20120 A vulnerability in the access control list (ACL) Object Group Search (OGS) imple... |
medium | 5.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20121 A vulnerability in the access control list (ACL) Object Group Search (OGS) imple... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2025-56566 MikroTik firmware 7.19.4 stores sensitive authentication credentials and network... |
medium | 4.6 | — | — | 2026-09-16 | 2026-10-14 |
| CVE-2026-92475 A weakness has been identified in GPAC 26.08-DEV. |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92526 A flaw has been found in itsourcecode Leave Management System 1.0. |
medium | 6.3 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-87113 Tanium addressed an improper access controls vulnerability in Threat Response. |
medium | 6.3 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-87116 Tanium addressed a server-side request forgery vulnerability in Threat Response. |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-87076 Tanium addressed an information disclosure vulnerability in Discover. |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-81866 Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and veri... |
medium | 4.3 | — | Apache / nifi | 2026-09-16 | 2026-09-21 |
| CVE-2026-82561 Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entir... |
medium | 6.5 | — | Apache / nifi | 2026-09-16 | 2026-09-21 |
| CVE-2026-62949 AsyncSSH is a Python package which provides an asynchronous client and server im... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-92417 A vulnerability was found in Open5GS up to 2.8.0. |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-81176 Svelte devalue is a JavaScript library that serializes values into strings when... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-75025 Mattermost Desktop App versions <=6.2 6.2.2.0 Fixed an issue where Mattermost De... |
medium | 4.7 | — | Mattermost / mattermost desktop | 2026-09-16 | 2026-10-13 |
| CVE-2026-73457 Under certain circumstances on affected platforms running Arista EOS with gRPC N... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-73462 On affected platforms running Arista EOS with IGMP (Internet Group Management Pr... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-73443 On affected platforms running Arista EOS with VRRPv2 IP-AH authentication config... |
medium | 4.7 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-63225 Redocly CLI makes OpenAPI validation, linting, and documentation workflows easie... |
medium | 4.4 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-92605 IRIS through 2.4.29 fails to properly validate case authorization in comment lis... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92416 A vulnerability has been found in Open5GS up to 2.8.0. |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.