September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-16652 Temporal Server did not bound the work performed while searching for a Schedule'... |
not reported | — | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-77021 Improper handling of highly compressed data (data amplification) in Checkmk <2.5... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-92612 In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its c... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94277 MISP's galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-91921 Cross-Site Scripting (XSS) vulnerability due to inadequate input sanitisation in... |
not reported | — | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2025-12999 UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icon... |
not reported | — | — | — | 2026-09-21 | 2026-10-14 |
| CVE-2026-90839 Rejected reason: this is rejected |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-88855 Joomla Extension - OrdaSoft.com - Authenticated, Privileged SQL Injection in Ord... |
not reported | — | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-88856 Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Executio... |
not reported | — | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-88857 Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Executio... |
not reported | — | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-88854 Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joom... |
not reported | — | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-92252 Incorrect default permissions in the installation directory of WatchDog Anti-Vir... |
not reported | — | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-92253 Improper link resolution before file access in the quarantine restoration proces... |
not reported | — | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-92254 Missing Authorization in the IOCTL handlers of the wsdkd.sys kernel drivers in W... |
not reported | — | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-89155 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-19 | 2026-10-16 |
| CVE-2026-82672 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')... |
not reported | — | — | — | 2026-09-19 | 2026-09-22 |
| CVE-2026-77875 The application protects access through its calculator-style vault passcode, but... |
not reported | — | — | — | 2026-09-19 | 2026-09-22 |
| CVE-2026-93894 In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found i... |
not reported | — | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-63646 CordysCRM is an open source AI-powered customer relationship management system t... |
not reported | — | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-63647 CordysCRM is an open source AI-powered customer relationship management system t... |
not reported | — | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-93852 In OpenStack Blazar before 17.0.1, the V2 lease listing operation (GET /v2/lease... |
not reported | — | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93854 In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-leve... |
not reported | — | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-63445 Perses is an open-source dashboard and visualization project for observability d... |
not reported | — | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-63458 Perses is an open-source dashboard and visualization project for observability d... |
not reported | — | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-64847 AnyIO is a high level asynchronous concurrency and networking framework that wor... |
not reported | — | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-63199 Perses is an open-source dashboard and visualization project for observability d... |
not reported | — | — | — | 2026-09-18 | 2026-09-30 |
| CVE-2026-81505 Convoy is a cloud native webhooks gateway. |
not reported | — | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-73863 NanoMQ is an MQTT broker. |
not reported | — | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-77339 Process Compose is a scheduler and orchestrator for non-containerized applicatio... |
not reported | — | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-62943 btrbk is a tool for creating snapshots and remote backups of Btrfs subvolumes. |
not reported | — | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-63349 AnyIO is a high level asynchronous concurrency and networking framework that wor... |
not reported | — | — | — | 2026-09-18 | 2026-09-25 |
| CVE-2026-55556 Rsyslog is a rocket-fast system for log processing. |
not reported | — | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-77568 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-68914 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-60115 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-18 | 2026-10-16 |
| CVE-2026-93598 ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 contains a... |
not reported | — | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-92976 A stored Cross-Site Scripting (XSS) vulnerability in the profile management func... |
not reported | — | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-15579 An out-of-bounds write vulnerability exists in some of the Ethernet switches bec... |
not reported | — | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2024-27123 A cross-site scripting (XSS) vulnerability has been reported to affect QcalAgent... |
not reported | — | — | — | 2026-09-18 | 2026-09-28 |
| CVE-2026-79954 NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the T... |
not reported | — | — | — | 2026-09-18 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.