September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-90826 A vulnerability was determined in GPAC 26.07.0. |
low | 2.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90827 A vulnerability was identified in GPAC 26.07.0. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90824 A vulnerability has been found in GPAC 26.07.0. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-86891 An authorization issue was addressed with improved state management. |
low | 3.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-86893 A permissions issue was addressed with additional restrictions. |
low | 3.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-86887 A privacy issue was addressed by removing sensitive data. |
low | 3.3 | — | Apple / ipados | 2026-09-14 | 2026-09-21 |
| CVE-2026-86888 A permissions issue was addressed with additional restrictions. |
low | 3.3 | — | Apple / ipados | 2026-09-14 | 2026-09-21 |
| CVE-2026-84626 An information disclosure issue was addressed with improved state management. |
low | 3.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84530 An information disclosure issue was addressed with improved memory management. |
low | 3.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-65371 This issue was addressed with improved redaction of sensitive information. |
low | 3.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-19086 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a denial of service as a result of a bu... |
low | 3.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-16190 IBM WebSphere Application Server 9.0, and 8.5 is affected by an authorization by... |
low | 3.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90811 A weakness has been identified in cosmicstack-labs mercury-agent up to 1.2.0. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-57583 OpenZeppelin Contracts Wizard is a web application to interactively build a cont... |
low | 3.3 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-55866 SpiceDB is an open source database system for creating and managing security-cri... |
low | 3.7 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-49400 October System provides the system module for October Content Management System. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-44162 fluent-plugin-s3 is an Amazon S3 input and output plugin for Fluentd. |
low | 2.7 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-46696 October System provides the system module for October Content Management System. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54541 Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the... |
low | 3.7 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54542 Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the... |
low | 3.7 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-90713 A security flaw has been discovered in vllm-project vLLM up to 0.29.0. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90696 A vulnerability was determined in SourceCodester Inventory Management System 1.0... |
low | 3.5 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90695 A vulnerability was found in SourceCodester Inventory Management System 1.0. |
low | 3.5 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90694 A vulnerability has been found in SourceCodester Inventory Management System 1.0... |
low | 3.5 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2025-26790 Withsecure Atlant with Capricorn engine before 2025-01-20_02 allows a Remote Den... |
low | 3.7 | — | — | 2026-09-14 | 2026-10-14 |
| CVE-2026-25832 In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accept... |
low | 3.7 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-90685 A vulnerability has been found in GPAC up to f1219cde. |
low | 2.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2023-37253 An issue was discovered in the ProofreadPage extension for MediaWiki through 1.3... |
low | 3.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2023-37366 An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor... |
low | 2.8 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-90684 A flaw has been found in GPAC up to f1219cde. |
low | 2.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90681 A weakness has been identified in Matthias-Wandel jhead up to 3.3. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90683 A vulnerability was detected in GPAC up to f1219cde. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2023-32778 An issue was discovered in ILIAS 6.23, 7 before 7.22, and 8.1. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-37252 An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. |
low | 3.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2023-24285 Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a b... |
low | 2.9 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-24286 Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a b... |
low | 2.9 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-24287 Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a b... |
low | 2.9 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-24288 An issue in Portable Puzzle Collection before 20230116.5782e29 allows attackers... |
low | 2.9 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-24291 Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a b... |
low | 2.9 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-24284 Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a b... |
low | 2.9 | — | — | 2026-09-14 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.