September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,827
Low
527
Severity not reported
2,543
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-65323 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-17 | 2026-10-16 |
| CVE-2026-78668 Rejected reason: reserved but not needed |
not reported | — | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-86688 Session Fixation vulnerability in team-alembic ash_authentication allows an atta... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-76949 Authentication Bypass by Spoofing vulnerability in team-alembic ash_authenticati... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-54608 MythicalDash is a Pterodactyl client area. |
not reported | — | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-54633 PoDoFo is a C++17 PDF manipulation library. |
not reported | — | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54642 CubeCart is an ecommerce software solution. |
not reported | — | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-53556 SQLBot is an intelligent Text-to-SQL system based on large language models and R... |
not reported | — | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-53557 SQLBot is an intelligent Text-to-SQL system based on large language models and R... |
not reported | — | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-54343 Frappe Learning Management System (LMS) is a learning system that helps users st... |
not reported | — | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-54507 Vvveb is a powerful and easy to use CMS with page builder to build websites, blo... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-53534 JabRef is a desktop application for managing BibTeX and BibLaTeX libraries. |
not reported | — | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-53554 SQLBot is an intelligent Text-to-SQL system based on large language models and R... |
not reported | — | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-53555 SQLBot is an intelligent Text-to-SQL system based on large language models and R... |
not reported | — | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-11432 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-17 | 2026-10-16 |
| CVE-2026-57847 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-17 | 2026-10-15 |
| CVE-2026-54604 OpenSlide is a C library for reading whole slide image files. |
not reported | — | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-54355 MapServer is a system for developing web-based GIS applications. |
not reported | — | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-54501 Browsertrix is a high-fidelity, browser-based crawling service for web archiving... |
not reported | — | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54237 Wavelog is web-based amateur radio logging software. |
not reported | — | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-48977 OpenSlide is a C library for reading whole slide image files. |
not reported | — | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-49137 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-17 | 2026-10-16 |
| CVE-2025-62167 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-09-17 | 2026-10-07 |
| CVE-2026-10594 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-17 | 2026-10-16 |
| CVE-2026-11314 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-17 | 2026-10-16 |
| CVE-2026-57846 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-17 | 2026-10-15 |
| CVE-2026-54594 OmniBlocks is a monorepo for the OmniBlocks project. |
not reported | — | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-54649 punchin-email is a Cloudflare Email Worker that provides two-way role aliases wh... |
not reported | — | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-55061 uniget is a universal installer and updater for (container) tools. |
not reported | — | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-55062 uniget is a universal installer and updater for (container) tools. |
not reported | — | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-54451 Elixir protobuf is a pure Elixir implementation of Google Protobuf. |
not reported | — | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54524 Frappe HR is an open-source human resources management solution (HRMS). |
not reported | — | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-54571 ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32... |
not reported | — | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-49292 Kiwi TCMS is an open source test management system. |
none | 0.0 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-52836 OpenDDS is an open source C++ implementation of the Object Management Group (OMG... |
not reported | — | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-93295 MISP contains a vulnerability in its background job dispatch mechanism that allo... |
not reported | — | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-93296 MISP contains a stored cross-site scripting (XSS) vulnerability in the Overmind... |
not reported | — | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-9314 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-17 | 2026-10-16 |
| CVE-2026-93198 In the Linux kernel, the following vulnerability has been resolved:
dm-pcache:... |
not reported | — | — | — | 2026-09-17 | 2026-10-19 |
| CVE-2026-93199 In the Linux kernel, the following vulnerability has been resolved:
i3c: master... |
not reported | — | — | — | 2026-09-17 | 2026-10-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.