September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-54585 mport is the MidnightBSD Package Manager. |
not reported | — | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-54586 mport is the MidnightBSD Package Manager. |
not reported | — | — | — | 2026-09-17 | 2026-09-21 |
| CVE-2026-54575 mport is the MidnightBSD Package Manager. |
not reported | — | — | — | 2026-09-17 | 2026-09-21 |
| CVE-2026-54576 mport is the MidnightBSD Package Manager. |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-54577 mport is the MidnightBSD Package Manager. |
not reported | — | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54578 mport is the MidnightBSD Package Manager. |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-91039 Authentication Bypass by Spoofing vulnerability in team-alembic ash_authenticati... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-69197 Umbraco is an ASP.NET CMS. |
not reported | — | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-88952 Improper Authentication vulnerability in team-alembic AshAuthentication allows a... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-71538 @cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm p... |
not reported | — | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-79752 CakePHP is a rapid development framework for PHP. |
not reported | — | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-61793 Nuxt OG Image generates OG Images with Vue templates in Nuxt. |
not reported | — | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-92962 vm2 is a sandbox for running untrusted JavaScript. |
not reported | — | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-89418 google-protobuf contains an unbounded recursion when parsing unknown protobuf gr... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-85500 Authentication Bypass by Primary Weakness vulnerability in team-alembic AshAuthe... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-86522 Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthent... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-86533 Insufficient Session Expiration vulnerability in team-alembic AshAuthentication... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-82759 Use of a One-Way Hash with a Predictable Salt vulnerability in team-alembic AshA... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-82760 Inefficient Algorithmic Complexity vulnerability in team-alembic AshAuthenticati... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-82761 Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in team-alembic... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-81637 Insufficient Session Expiration vulnerability in team-alembic AshAuthentication... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-82685 Authorization Bypass Through User-Controlled Key vulnerability in team-alembic A... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-82723 Insertion of Sensitive Information into Log File vulnerability in team-alembic A... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-81632 Use of HTTP Request With Sensitive Query String vulnerability in team-alembic As... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-80218 Improper Authentication vulnerability in team-alembic AshAuthentication allows a... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-78223 Improper Verification of Cryptographic Signature vulnerability in team-alembic A... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-14850 The password reset funcionality is vulnerable to unauthorized account modificati... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-92932 In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/U... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-53681 Rejected reason: Red Hat Product Security has come to the conclusion that this C... |
not reported | — | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-53679 Rejected reason: Red Hat Product Security has come to the conclusion that this C... |
not reported | — | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-11874 Rejected reason: Red Hat Product Security has come to the conclusion that this C... |
not reported | — | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92611 In Eclipse Ankaios versions 0.6.0 to before 1.0.4, `LogRule::matches` in the age... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-78426 The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same... |
not reported | — | — | — | 2026-09-17 | 2026-09-28 |
| CVE-2026-78427 The NeuVector admission webhook silently excludes containers from policy evaluat... |
not reported | — | — | — | 2026-09-17 | 2026-09-28 |
| CVE-2026-78428 For users authenticated through SAML or OpenID Connect (OIDC), this vulnerabilit... |
not reported | — | — | — | 2026-09-17 | 2026-09-28 |
| CVE-2026-78425 Authorised users of outside applications behind the same corporate identity prov... |
not reported | — | — | — | 2026-09-17 | 2026-09-28 |
| CVE-2026-50608 A vulnerability has been identified in the Acer System Monitoring component incl... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-50609 A vulnerability has been identified in the Acer System Monitoring component incl... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-50610 A vulnerability has been identified in the Acer System Monitoring component incl... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-15688 Incorrect Implementation of Authentication Algorithm Vulnerability in Mitsubishi... |
not reported | — | — | — | 2026-09-17 | 2026-10-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.