September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84483 WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass... |
medium | 5.3 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84477 AVideo Live_schedule::setTitle() and setDescription() store POST input without s... |
medium | 5.4 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84373 Vitest is a testing framework powered by Vite. |
medium | 5.9 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84288 A vulnerability has been found in NousResearch hermes-agent up to 0.18.2. |
medium | 4.3 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-84289 A vulnerability was found in NousResearch hermes-agent up to 0.18.2. |
medium | 4.3 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-84369 SVGO, short for SVG Optimizer, is a Node.js library and command-line application... |
medium | 6.1 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84371 ApostropheCMS is an open-source Node.js content management system, and sanitize-... |
medium | 5.4 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84470 A flaw was found in Ansible Automation Platform's automation-controller (AWX). |
medium | 6.4 | — | — | 2026-09-01 | 2026-09-24 |
| CVE-2026-84363 Hono is a Web application framework that provides support for any JavaScript run... |
medium | 5.9 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84364 Hono is a Web application framework that provides support for any JavaScript run... |
medium | 5.3 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84365 Hono is a Web application framework that provides support for any JavaScript run... |
medium | 6.5 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84287 A flaw has been found in NousResearch hermes-agent 0.18.0. |
medium | 4.3 | — | — | 2026-09-01 | 2026-09-04 |
| CVE-2026-73783 Stack overflow vulnerabilities exist in an API endpoint of AOS-CX. |
medium | 4.9 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-10-05 |
| CVE-2026-73772 Buffer overflow vulnerabilities exist in an underlying service of AOS-CX that co... |
medium | 6.5 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73755 A privilege escalation vulnerability exists in the API endpoint of AOS-CX. |
medium | 5.7 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73756 A vulnerability in an API endpoint of AOS-CX could allow a remote unauthenticate... |
medium | 5.9 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73757 A vulnerability in the web-based management interface of AOS-CX could allow an a... |
medium | 6.4 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73758 A privilege escalation vulnerability exists in the API endpoint of AOS-CX. |
medium | 6.5 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73759 Vulnerabilities in AOS-CX could allow an unauthenticated remote malicious actor... |
medium | 6.5 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-22 |
| CVE-2026-73760 An authenticated Path Traversal vulnerability exists in AOS-CX. |
medium | 6.5 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73761 An out-of-bounds read vulnerability exists in the underlying operating system of... |
medium | 6.5 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73762 A vulnerability has been identified in the API endpoint of AOS-CX that could all... |
medium | 6.6 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73754 Denial-of-service vulnerabilities exist in the command line interface of AOS-CX. |
medium | 5.3 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73524 Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contact... |
medium | 6.1 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-63435 Mail is an internet library for Ruby designed to handle email generation, parsin... |
medium | 5.3 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84309 pypdf is a free and open-source pure-python PDF library. |
medium | 5.5 | — | Pypdf Project / pypdf | 2026-09-01 | 2026-10-05 |
| CVE-2026-78608 Missing Authorization (CWE-862) in Kibana can lead to information disclosure via... |
medium | 6.5 | — | Elastic / kibana | 2026-09-01 | 2026-09-02 |
| CVE-2026-84308 phpseclib is a PHP secure communications library. |
medium | 6.3 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-78597 Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to u... |
medium | 4.3 | — | Elastic / kibana | 2026-09-01 | 2026-09-02 |
| CVE-2026-78603 Missing Authorization (CWE-862) in Kibana can lead to information disclosure via... |
medium | 4.3 | — | Elastic / kibana | 2026-09-01 | 2026-09-02 |
| CVE-2026-78605 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444... |
medium | 5.9 | — | Elastic / elasticsearch | 2026-09-01 | 2026-09-02 |
| CVE-2026-78606 Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure,... |
medium | 4.2 | — | Elastic / kibana | 2026-09-01 | 2026-09-02 |
| CVE-2026-73734 A vulnerability in the web-based management interface of HPE Networking Fabric C... |
medium | 5.4 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-03 |
| CVE-2026-73735 Vulnerabilities in the API of HPE Networking Fabric Composer could allow an auth... |
medium | 5.4 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-03 |
| CVE-2026-73736 A vulnerability in the web-based management interface of HPE Networking Fabric C... |
medium | 5.3 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-03 |
| CVE-2026-73737 An unauthenticated path traversal vulnerability exists in the API endpoint of HP... |
medium | 4.8 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-03 |
| CVE-2026-73738 A vulnerability in the underlying operating system of HPE Networking Fabric Comp... |
medium | 4.7 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-03 |
| CVE-2026-73739 A vulnerability exists in the API of HPE Networking Fabric Composer that allows... |
medium | 4.4 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-03 |
| CVE-2026-73740 A local privilege escalation vulnerability in HPE Networking Fabric Composer cou... |
medium | 4.4 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-03 |
| CVE-2026-73741 A vulnerability in the API of HPE Networking Fabric Composer could allow an auth... |
medium | 4.3 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-03 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.