September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-79616 Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Contex... |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-92378 A session management
vulnerability exists in the Legacy UI Reduced Function Logi... |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-50228 An unauthenticated local attacker can connect to the Electron DevTools endpoint... |
not reported | — | — | — | 2026-09-23 | 2026-09-25 |
| CVE-2026-50227 An unauthenticated local attacker can connect to the MQTT broker over its localh... |
not reported | — | — | — | 2026-09-23 | 2026-09-25 |
| CVE-2026-19202 A caching flaw in the toolbox-core package of the mcp-toolbox-sdk-python SDK cau... |
not reported | — | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-96269 GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file,... |
not reported | — | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-89019 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-22 | 2026-10-16 |
| CVE-2026-76910 Unleash is an open-source feature management platform. |
not reported | — | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-77426 Unleash is an open-source feature management platform. |
not reported | — | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-76909 Unleash is an open-source feature management platform. |
not reported | — | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-63627 mppx is a TypeScript interface for machine payments protocol. |
not reported | — | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-63628 mppx is a TypeScript interface for machine payments protocol. |
not reported | — | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-91130 Home Assistant is open source home automation software focused on local control... |
not reported | — | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-8849 Use After Free vulnerability in RTI Connext Professional (Security Plugins) allo... |
not reported | — | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-7866 Stack-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libr... |
not reported | — | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-18461 Use of Externally-Controlled Format String vulnerability in RTI Connext Professi... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-18462 Integer Overflow or Wraparound, Improper Access Control vulnerability in RTI Con... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-18626 Out-of-bounds Read vulnerability in RTI Connext Professional (Core Libraries) al... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-18457 Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libra... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-18458 Out-of-bounds Read, Function Call With Incorrect Number of Arguments, Access of... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-18459 Incorrect Calculation vulnerability in RTI Connext Professional (Core Libraries)... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-18460 Off-by-one Error, Out-of-bounds Write vulnerability in RTI Connext Professional... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-11388 Double Free vulnerability in RTI Connext Professional (Core Libraries) allows Fi... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-11389 Out-of-bounds Read, Function Call With Incorrect Number of Arguments, Access of... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-83803 Sentry is an error tracking and performance monitoring tool. |
not reported | — | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-76819 Rejected reason: Further research determined the issue results from a dependency... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-13087 Rejected reason: This CVE was reserved in error and duplicates CVE-2026-89530. |
not reported | — | — | — | 2026-09-22 | 2026-09-30 |
| CVE-2026-95805 A typo in the MISP ACLComponent access control configuration caused the ACL rule... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95806 MISP ships with PHP's phar stream wrapper registered in both its web entry point... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-86698 Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm h... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-85055 Twenty is an open-source CRM (customer relationship management) platform. |
not reported | — | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-77619 Vector is a high-performance observability data pipeline. |
not reported | — | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-77620 Vector is a high-performance observability data pipeline. |
not reported | — | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-77621 Vector is a high-performance observability data pipeline. |
not reported | — | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-75511 Novu provides an API for sending notifications through multiple channels. |
not reported | — | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-75510 Novu provides an API for sending notifications through multiple channels. |
not reported | — | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-63374 AnyIO is a high level asynchronous concurrency and networking framework that wor... |
not reported | — | — | — | 2026-09-22 | 2026-09-28 |
| CVE-2026-95701 In MISP, the __statisticsOrgs method in UsersController.php used the organizatio... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95703 In MISP, the OrganisationsController::__uploadLogo method processed a caller-sup... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95754 In MISP's UsersController login() method, the pre-authentication database query... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.