September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-94571 In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject c... |
not reported | — | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-61647 NotebookLM MCP is an MCP server and HTTP service for interacting with Google Not... |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-46649 Joplin is an open source note-taking and to-do application that organises notes... |
not reported | — | — | — | 2026-09-21 | 2026-09-28 |
| CVE-2026-52835 Tautulli is a Python based monitoring and tracking tool for Plex Media Server. |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-45381 Tautulli is a Python based monitoring and tracking tool for Plex Media Server. |
not reported | — | — | — | 2026-09-21 | 2026-09-29 |
| CVE-2026-49995 Tautulli is a Python based monitoring and tracking tool for Plex Media Server. |
not reported | — | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-91167 Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-66280 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-21 | 2026-10-16 |
| CVE-2026-55473 HomeBox is a home inventory and organization system. |
not reported | — | — | — | 2026-09-21 | 2026-09-29 |
| CVE-2026-77582 Tinyauth is an authentication and authorization server. |
not reported | — | — | — | 2026-09-21 | 2026-09-30 |
| CVE-2026-76898 draw.io is a configurable diagramming and whiteboarding application. |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-61674 Fluent Bit is a fast and lightweight logs, metrics, and traces processor for Lin... |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-55563 Feast is the open source feature store for AI and machine learning. |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-71543 OpenBao is an open source identity-based secrets management system. |
not reported | — | — | — | 2026-09-21 | 2026-09-25 |
| CVE-2026-55870 GoCD is a continuous deliver server. |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-68919 GoCD is a continuous deliver server. |
not reported | — | — | — | 2026-09-21 | 2026-09-25 |
| CVE-2026-54584 mport is the MidnightBSD Package Manager. |
not reported | — | — | — | 2026-09-21 | 2026-09-25 |
| CVE-2026-55074 Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeB... |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-52740 GoCD is a continuous deliver server. |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-52741 GoCD is a continuous deliver server. |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-52742 GoCD is a continuous deliver server. |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-94404 MISP has a security issue that could let an attacker change threat-intelligence... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-93884 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94393 When a user creates or edits a report inside an event, MISP can identify an exis... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94394 When a regular user adds a reference between objects or attributes, MISP checks... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94401 MISP has a file-handling vulnerability that could let certain authenticated user... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-88807 A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be u... |
not reported | — | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94379 The login() function in MISP's UsersController.php contained insufficient HTTP m... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94381 MISP has a security issue that can let a user gain more access than their API ke... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94383 The MISP blocklist workflow module accepted a user-supplied blocklist filename p... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94372 MISP contains a stored cross-site scripting (XSS) vulnerability in the default t... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94373 MISP contains a DOM-based cross-site scripting (XSS) vulnerability in the contex... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94374 MISP contains an insecure direct object reference vulnerability in the processMo... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-89139 Temporal Server compiles a Worker Controller Instance module into its Worker Ser... |
not reported | — | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-87858 Temporal Server decided whether a Workflow completion callback was internal by r... |
not reported | — | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-65654 github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an... |
not reported | — | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-65651 temporalio/sqlparser accepts SQL containing deeply nested unary expressions and... |
not reported | — | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-65652 github.com/temporalio/tchannel-go did not validate the one-byte checksum-type fi... |
not reported | — | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-65653 github.com/temporalio/tchannel-go did not reject TChannel call fragments contain... |
not reported | — | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-16651 temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processe... |
not reported | — | — | — | 2026-09-21 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.