September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-17270 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to cause a denial of s... |
medium | 5.5 | — | Ibm / i | 2026-09-04 | 2026-09-10 |
| CVE-2026-17273 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to caus... |
medium | 6.5 | — | Ibm / i | 2026-09-04 | 2026-09-10 |
| CVE-2026-17274 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypa... |
medium | 5.4 | — | Ibm / i | 2026-09-04 | 2026-09-09 |
| CVE-2026-17440 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.... |
medium | 5.5 | — | Ibm / app connect enterprise | 2026-09-04 | 2026-09-09 |
| CVE-2026-16660 IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to cause a... |
medium | 5.3 | — | Ibm / db2 mirror for i | 2026-09-04 | 2026-09-10 |
| CVE-2026-16689 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.... |
medium | 5.5 | — | Ibm / app connect enterprise | 2026-09-04 | 2026-09-08 |
| CVE-2026-16693 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obta... |
medium | 4.9 | — | Ibm / i | 2026-09-04 | 2026-09-08 |
| CVE-2026-16892 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypa... |
medium | 5.4 | — | Ibm / i | 2026-09-04 | 2026-09-08 |
| CVE-2026-16941 IBM i 7.6, 7.5, and 7.4 could allow a remote authenticated attacker to modify ce... |
medium | 4.3 | — | Ibm / i | 2026-09-04 | 2026-09-10 |
| CVE-2026-14350 IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 could allow an un... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-14470 IBM Langflow OSS 1.0.0 through 1.10.2 could allow an authenticated attacker to t... |
medium | 6.5 | — | Langflow / langflow | 2026-09-04 | 2026-09-10 |
| CVE-2026-16180 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.... |
medium | 5.7 | — | Ibm / app connect enterprise | 2026-09-04 | 2026-09-09 |
| CVE-2026-75170 Cross-site scripting (XSS) vulnerability in the /loginController/doLogin endpoin... |
medium | 6.1 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-78658 IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.25, and 7.3 through 7.3.2.20 an... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-78970 JeecgBoot 3.9.2 and earlier contains an authorization bypass vulnerability in th... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-75162 An information disclosure vulnerability in the opcua-configuration method of /cg... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-75163 An information disclosure vulnerability in the ugw-deviceinfo method of /cgi-bin... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-75164 An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solution... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-75165 An issue in /cgi-bin/wwwugw.cgi of MBS-Solutions X-Serie Gateway firmware V6_00_... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-75167 A broken access control vulnerability in the ugw-usr-edit method of /cgi-bin/www... |
medium | 4.3 | — | — | 2026-09-04 | 2026-09-14 |
| CVE-2026-75168 An issue in the ugw-editfile method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Se... |
medium | 6.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-19649 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.... |
medium | 5.5 | — | Ibm / app connect enterprise | 2026-09-04 | 2026-09-09 |
| CVE-2026-5522 IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 005 contains hard-coded credenti... |
medium | 6.7 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-19645 IBM MQ Agent CD: v1.0.0, v1.0.1, v2.0.0, v2.0.1 An authenticated user with a val... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-19302 IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacke... |
medium | 6.5 | — | Langflow / langflow | 2026-09-04 | 2026-09-08 |
| CVE-2026-19299 IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacke... |
medium | 6.5 | — | Langflow / langflow | 2026-09-04 | 2026-09-08 |
| CVE-2026-19301 IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacke... |
medium | 6.5 | — | Langflow / langflow | 2026-09-04 | 2026-09-08 |
| CVE-2026-18858 IBM i 7.6, and 7.5 could allow a local authenticated attacker to obtain informat... |
medium | 5.5 | — | Ibm / i | 2026-09-04 | 2026-09-08 |
| CVE-2026-18887 IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated attacker to obtain sen... |
medium | 6.5 | — | Ibm / i | 2026-09-04 | 2026-09-08 |
| CVE-2026-18567 IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a local attacker to obtain in... |
medium | 4.7 | — | Ibm / db2 mirror for i | 2026-09-04 | 2026-09-08 |
| CVE-2022-35497 In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identif... |
medium | 5.4 | — | — | 2026-09-04 | 2026-09-14 |
| CVE-2026-9138 IBM Langflow OSS 1.0.0 through 1.11.2 Langflow could allow an authenticated atta... |
medium | 6.5 | — | Langflow / langflow | 2026-09-04 | 2026-09-10 |
| CVE-2026-9186 IBM Langflow OSS 1.0.0 through 1.11.2 allows remote authenticated attackers to b... |
medium | 6.5 | — | Langflow / langflow | 2026-09-04 | 2026-09-08 |
| CVE-2026-85700 Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored i... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-8447 IBM Langflow OSS 1.0.0 through 1.11.2 suffer from a stored cross-site scripting... |
medium | 6.1 | — | Langflow / langflow | 2026-09-04 | 2026-09-08 |
| CVE-2026-85697 Documenso 2.17.0 contains an access control vulnerability in the PDF-serving end... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-24 |
| CVE-2026-85698 Turso through 0.8.0-pre.8 contains an out-of-bounds read vulnerability in the ta... |
medium | 5.5 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-85692 Nightingale (n9e), as of commit 8362cbe (main branch, confirmed 2026-08-27), con... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-85693 Chatbot UI contains an authorization bypass vulnerability in the retrieval endpo... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-24 |
| CVE-2026-85689 llmware 0.4.6 contains an SQL injection vulnerability in the collection-database... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.