September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-28934 A buffer overflow was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-28937 This issue was addressed through improved state management. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-28966 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 4.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-18069 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain ownership of... |
medium | 6.0 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-19273 IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6_2, 6.2.1.0 - 6.2.1.2, 6.2.2.... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-19280 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a denial of service as a result of a bu... |
medium | 5.2 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-14275 IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could... |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-17 |
| CVE-2026-14276 IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could... |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-17 |
| CVE-2026-14277 IBM i Access Family 1.1.2.0 through 1.1.9.15 could allow an authenticated user t... |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-17 |
| CVE-2026-13272 IBM Verify Identity Access is missing origin validation which could allow a remo... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-20 |
| CVE-2026-13276 IBM Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001 and IBM Securit... |
medium | 6.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-13277 IBM Verify Identity Access could allow a remote attacker to conduct phishing att... |
medium | 4.7 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-12763 IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to a... |
medium | 4.2 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-12765 IBM Langflow OSS 1.0.0 through 1.10.2 is vulnerable to server-side request forge... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-12766 IBM Langflow OSS 1.0.0 through 1.11.2 is vulnerable to server-side request forge... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-12767 IBM Langflow OSS 1.0.0 through 1.11.5 is vulnerable to server-side request forge... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90816 A vulnerability was found in FFmpeg 8.0.x. |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90813 A vulnerability was detected in cosmicstack-labs mercury-agent up to 1.1.13. |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90814 A flaw has been found in cosmicstack-labs mercury-agent up to 1.1.13. |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90815 A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-73497 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-55093 Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolk... |
medium | 6.1 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-55244 ASTEVAL is an evaluator of Python expressions and statements. |
medium | 5.0 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-53717 Envoy Gateway is an open source project for managing Envoy Proxy as a standalone... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54246 Skipper is an HTTP router and reverse proxy for service composition. |
medium | 5.7 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-54247 Skipper is an HTTP router and reverse proxy for service composition. |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-17628 IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacke... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-18065 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to ga... |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-18251 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive i... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-16702 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Win... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-17047 IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain s... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-17463 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Win... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-16189 IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to i... |
medium | 4.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-16432 IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage PxXMLInput operator co... |
medium | 6.5 | — | Ibm / datastage on cloud pak for data | 2026-09-14 | 2026-10-06 |
| CVE-2026-16435 IBM WebSphere Application Server 9.0, and 8.5 is affected by an authentication b... |
medium | 5.9 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-16147 The ITE IT82xx2 USB device-controller driver (drivers/usb/udc/udc_it82xx2.c) mis... |
medium | 6.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-16148 The ITE it82xx2 USB device-controller driver initialized its bus-suspend detecti... |
medium | 4.6 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-16185 IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to b... |
medium | 6.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-16186 IBM WebSphere Application Server 9.0, and 8.5 is affected by a reflected cross-s... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-16187 IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to b... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.