September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-97863 The cisco_firesight_manager_ACL_rule_export module in misp-modules generates a s... |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-6082 Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management... |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-6083 Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management... |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-6084 Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management... |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-6085 Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management... |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-6086 Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management... |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-6087 Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management... |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-6088 Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management... |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-93477 Improperly Controlled Modification of Dynamically-Determined Object Attributes v... |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-53493 containerd is an open-source container runtime. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-85417 Incomplete property masking in the SANnav logging subsystem permits SNMP authent... |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-84283 Secure Folder 1.2 stores files selected for its password-protected vault as unen... |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-85082 Root Browser Classic 3.3.0 passes the path of a selected SQLite database to an o... |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-97387 Rejected reason: This CVE is a duplicate of another CVE. |
not reported | — | — | — | 2026-09-24 | 2026-10-16 |
| CVE-2026-87720 Incorrect Authorization (CWE-863) in project name normalization (ProjectUtil.str... |
not reported | — | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-87721 Uncontrolled Resource Consumption (CWE-400 / CWE-407) in the ANTLR 3 search quer... |
not reported | — | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-87722 Uncontrolled Resource Consumption (CWE-400 / CWE-1333) in regex search query pre... |
not reported | — | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-14443 Incomplete log sanitization during bulk IPsec policy collection in Brocade SANna... |
not reported | — | — | — | 2026-09-24 | 2026-10-01 |
| CVE-2026-14442 An information exposure vulnerability in the job scheduling component of SANnav... |
not reported | — | — | — | 2026-09-24 | 2026-10-01 |
| CVE-2026-14441 A logic flaw in Java cache key handling object comparison handling could lead to... |
not reported | — | — | — | 2026-09-24 | 2026-10-01 |
| CVE-2026-82372 Improper handling of sensitive data during IPsec policy creation and modificatio... |
not reported | — | — | — | 2026-09-24 | 2026-10-01 |
| CVE-2026-82371 Plaintext exposure of sensitive authentication data in Brocade SANnav discovery... |
not reported | — | — | — | 2026-09-24 | 2026-10-01 |
| CVE-2026-86857 ServiceNow has remediated an authorization bypass security issue that was identi... |
not reported | — | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-86858 ServiceNow has remediated an improper access control security issue that was ide... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-86859 ServiceNow has remediated an authorization bypass security issue that was identi... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-86860 ServiceNow has remediated a missing authorization vulnerability that was identif... |
not reported | — | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-13016 ServiceNow has remediated a SQL injection vulnerability that was identified in t... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-61742 DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB,... |
not reported | — | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-61604 The ixo Blockchain is a Layer 1 blockchain that runs on both Testnet and Mainnet... |
not reported | — | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-97521 In the Linux kernel, the following vulnerability has been resolved:
gfs2: fix q... |
not reported | — | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-97512 In the Linux kernel, the following vulnerability has been resolved:
spi: spi-qc... |
not reported | — | — | — | 2026-09-24 | 2026-10-03 |
| CVE-2026-97514 In the Linux kernel, the following vulnerability has been resolved:
media: chip... |
not reported | — | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-97515 In the Linux kernel, the following vulnerability has been resolved:
i3c: master... |
not reported | — | — | — | 2026-09-24 | 2026-10-21 |
| CVE-2026-97516 In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw88... |
not reported | — | — | — | 2026-09-24 | 2026-10-03 |
| CVE-2026-97517 In the Linux kernel, the following vulnerability has been resolved:
wifi: nl802... |
not reported | — | — | — | 2026-09-24 | 2026-10-03 |
| CVE-2026-97518 In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80... |
not reported | — | — | — | 2026-09-24 | 2026-10-21 |
| CVE-2026-97519 In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Fix... |
not reported | — | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-97503 In the Linux kernel, the following vulnerability has been resolved:
genirq/proc... |
not reported | — | — | — | 2026-09-24 | 2026-10-21 |
| CVE-2026-97504 In the Linux kernel, the following vulnerability has been resolved:
watchdog: l... |
not reported | — | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-97505 In the Linux kernel, the following vulnerability has been resolved:
PCI/sysfs:... |
not reported | — | — | — | 2026-09-24 | 2026-10-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.