September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-93212 In the Linux kernel, the following vulnerability has been resolved:
nfsd: guard... |
not reported | — | — | — | 2026-09-24 | 2026-10-19 |
| CVE-2026-93213 In the Linux kernel, the following vulnerability has been resolved:
of: fix out... |
not reported | — | — | — | 2026-09-24 | 2026-10-19 |
| CVE-2026-93214 In the Linux kernel, the following vulnerability has been resolved:
usb: gadget... |
not reported | — | — | — | 2026-09-24 | 2026-10-19 |
| CVE-2026-93215 In the Linux kernel, the following vulnerability has been resolved:
cdx: Fix do... |
not reported | — | — | — | 2026-09-24 | 2026-10-19 |
| CVE-2026-93216 In the Linux kernel, the following vulnerability has been resolved:
mm/page_own... |
not reported | — | — | — | 2026-09-24 | 2026-10-21 |
| CVE-2026-93217 In the Linux kernel, the following vulnerability has been resolved:
mm/madvise:... |
not reported | — | — | — | 2026-09-24 | 2026-10-19 |
| CVE-2026-93218 In the Linux kernel, the following vulnerability has been resolved:
mm/huge_mem... |
not reported | — | — | — | 2026-09-24 | 2026-10-19 |
| CVE-2026-93208 In the Linux kernel, the following vulnerability has been resolved:
kasan: fix... |
not reported | — | — | — | 2026-09-24 | 2026-10-30 |
| CVE-2026-93209 In the Linux kernel, the following vulnerability has been resolved:
Bluetooth:... |
not reported | — | — | — | 2026-09-24 | 2026-10-19 |
| CVE-2026-93210 In the Linux kernel, the following vulnerability has been resolved:
smb: client... |
not reported | — | — | — | 2026-09-24 | 2026-10-19 |
| CVE-2026-93205 In the Linux kernel, the following vulnerability has been resolved:
iommu/arm-s... |
not reported | — | — | — | 2026-09-24 | 2026-10-30 |
| CVE-2026-93206 In the Linux kernel, the following vulnerability has been resolved:
PCI/proc: U... |
not reported | — | — | — | 2026-09-24 | 2026-10-19 |
| CVE-2026-56739 Logto is the modern, open-source auth infrastructure for SaaS and AI apps. |
not reported | — | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-97404 In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature he... |
not reported | — | — | — | 2026-09-24 | 2026-09-26 |
| CVE-2026-90481 In PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-12559 A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenTex... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97058 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-24 | 2026-10-16 |
| CVE-2026-91187 Improper Verification of Cryptographic Signature vulnerability in dashbit nimble... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96515 This
vulnerability exists in the Netlink ICT HG323RW router due to insufficient... |
not reported | — | — | — | 2026-09-24 | 2026-10-12 |
| CVE-2026-7169 a vulnerability involving an unchecked search path element in Evope Collector, v... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-79680 Authentication bypass vulnerability in the password authentication mechanism of... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-4638 PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-4637 Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a refl... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-87739 An improper authentication vulnerability in PaperCut MF/NG allows an unauthentic... |
not reported | — | — | — | 2026-09-24 | 2026-10-13 |
| CVE-2026-82077 An improper limitation of a pathname to a restricted directory (path traversal)... |
not reported | — | — | — | 2026-09-24 | 2026-10-13 |
| CVE-2026-11744 An input validation vulnerability exists in the PaperCut Hive embedded applicati... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97168 Rejected reason: it is a suggestion |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-14780 A vulnerability exists in the PaperCut NG/MF platform's device-scripting functio... |
not reported | — | — | — | 2026-09-24 | 2026-10-13 |
| CVE-2026-97151 mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97152 Nanomsg versions 0.5-beta through 1.x before 1.2.3 has a remotely exploitable bu... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97149 In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-C... |
not reported | — | — | — | 2026-09-24 | 2026-10-06 |
| CVE-2026-82370 Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP... |
not reported | — | — | — | 2026-09-24 | 2026-10-01 |
| CVE-2026-57168 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-59980 hpack is an HTTP/2 Header Encoding for Python. |
not reported | — | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-57854 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-23 | 2026-10-16 |
| CVE-2026-82369 Insufficient input sanitization of shell metacharacters in the Brocade SANnav CL... |
not reported | — | — | — | 2026-09-23 | 2026-10-01 |
| CVE-2026-53968 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-23 | 2026-10-16 |
| CVE-2026-53969 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-23 | 2026-10-16 |
| CVE-2026-53978 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-23 | 2026-10-16 |
| CVE-2026-53979 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-23 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.