September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-73742 A vulnerability in an API endpoint of HPE Networking Fabric Composer could allow... |
medium | 4.3 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-03 |
| CVE-2026-73726 A vulnerability has been identified in the underlying operating system of HPE Ne... |
medium | 6.8 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73727 Vulnerabilities in the API of HPE Networking Fabric Composer could allow an auth... |
medium | 6.5 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73728 Denial-of-service vulnerabilities exist in the API of HPE Networking Fabric Comp... |
medium | 6.5 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-03 |
| CVE-2026-73729 A vulnerability in the underlying operating system of HPE Networking Fabric Comp... |
medium | 6.5 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-03 |
| CVE-2026-73730 A privilege escalation vulnerability exists in the API of HPE Networking Fabric... |
medium | 6.5 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-03 |
| CVE-2026-73731 A vulnerability in the web-based management interface of HPE Networking Fabric C... |
medium | 6.1 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-03 |
| CVE-2026-73732 A vulnerability in the underlying operating system of HPE Networking Fabric Comp... |
medium | 5.6 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-03 |
| CVE-2026-73733 Authentication bypasses in the API of HPE Networking Fabric Composer could allow... |
medium | 5.4 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-03 |
| CVE-2026-72654 Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning f... |
medium | 6.5 | — | Elastic / kibana | 2026-09-01 | 2026-09-02 |
| CVE-2026-72682 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lea... |
medium | 6.5 | — | Elastic / kibana | 2026-09-01 | 2026-09-02 |
| CVE-2026-72628 Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a de... |
medium | 6.5 | — | Elastic / kibana | 2026-09-01 | 2026-09-02 |
| CVE-2026-72633 Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss... |
medium | 4.3 | — | Elastic / kibana | 2026-09-01 | 2026-09-04 |
| CVE-2026-72641 Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized modificatio... |
medium | 5.4 | — | Elastic / kibana | 2026-09-01 | 2026-09-02 |
| CVE-2026-72644 Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input... |
medium | 6.5 | — | Elastic / kibana | 2026-09-01 | 2026-09-02 |
| CVE-2026-72652 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lea... |
medium | 6.5 | — | Elastic / kibana | 2026-09-01 | 2026-09-02 |
| CVE-2026-63138 Improper Neutralization of Special Elements in Data Query Logic (CWE-943) in Kib... |
medium | 6.5 | — | Elastic / kibana | 2026-09-01 | 2026-09-02 |
| CVE-2026-56143 Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch... |
medium | 4.9 | — | Elastic / elasticsearch | 2026-09-01 | 2026-09-04 |
| CVE-2026-33465 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lea... |
medium | 6.5 | — | Elastic / kibana | 2026-09-01 | 2026-09-02 |
| CVE-2026-84306 Filament is a collection of full-stack components for accelerated Laravel develo... |
medium | 6.5 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84267 A flaw was found in the SFTP backend in gvfs. |
medium | 4.3 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-84269 A flaw was found in the AFP backend in gvfs. |
medium | 6.5 | — | — | 2026-09-01 | 2026-09-04 |
| CVE-2026-84270 A flaw was found in the MTP backend in gvfs. |
medium | 4.3 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-84232 A flaw was found in pulpcore's content serving application. |
medium | 5.4 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-84205 GROWI contains an access control vulnerability in the GET /_api/v3/revisions/:id... |
medium | 6.5 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84206 Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit p... |
medium | 4.3 | — | Snipeitapp / snipe-it | 2026-09-01 | 2026-09-29 |
| CVE-2026-84207 Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and WebSo... |
medium | 5.4 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84204 GROWI contains an access control vulnerability in the GET /_api/v3/attachment/:i... |
medium | 6.5 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84153 A vulnerability was determined in Xinhu Rainrock RockOA up to 2.3.2. |
medium | 6.3 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-84114 A vulnerability has been found in Cleo Harmony up to 5.8.1.10. |
medium | 6.3 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-84110 A vulnerability was detected in Releasit Releasit COD Form & Upsells v1. |
medium | 5.3 | — | — | 2026-09-01 | 2026-09-04 |
| CVE-2026-83557 DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automat... |
medium | 5.6 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-79685 Dell PowerStore contains an Argument Injection vulnerability. |
medium | 6.5 | — | Dell / powerstoreos | 2026-09-01 | 2026-10-02 |
| CVE-2026-84109 A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. |
medium | 6.3 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-51756 Incorrect access control in the meshSlaveUpgfw function of TOTOLINK T6 4.1.5cu.7... |
medium | 5.9 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-51761 Incorrect access control in the updateLanIp function of TOTOLINK T6 4.1.5cu.748_... |
medium | 5.3 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-51748 Incorrect access control in the sendStaticInfoToMaster function of TOTOLINK T6 4... |
medium | 5.9 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-51752 Incorrect access control in the staticInfoSend function of TOTOLINK T6 4.1.5cu.7... |
medium | 5.3 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-84139 Clickjacking issue in the DOM: Events component. |
medium | 6.1 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84136 Other issue in the DOM: Navigation component. |
medium | 6.1 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.