September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-50605 A vulnerability has been identified in the Acer Agent Service component included... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-50606 A vulnerability has been identified in the Acer System Monitoring component incl... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-50607 A vulnerability has been identified in the Acer System Monitoring component incl... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-50604 A vulnerability has been identified in the Acer Agent Service component included... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-50603 A vulnerability has been identified in the Acer Agent Service component included... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-61599 djust provides Phoenix LiveView-style reactive server-side rendering for Django... |
not reported | — | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-85789 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-16 | 2026-10-16 |
| CVE-2026-61597 djust provides Phoenix LiveView-style reactive server-side rendering for Django... |
not reported | — | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-81869 OpenTelemetry-Go is the Go implementation of OpenTelemetry. |
not reported | — | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-81871 OpenTelemetry-Go is the Go implementation of OpenTelemetry. |
not reported | — | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-81872 OpenTelemetry-Go is the Go implementation of OpenTelemetry. |
not reported | — | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-62997 Kedro-Datasets provides data connectors for Kedro. |
not reported | — | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-92808 A server-side request forgery (SSRF) vulnerability exists in the UnifiedLogin se... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-89082 HP has identified potential security vulnerabilities in the HP Advance software... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-89083 HP
has identified potential security vulnerabilities in the HP Advance software... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-89084 HP
has identified potential security vulnerabilities in the HP Advance software... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-81870 OpenTelemetry-Go is the Go implementation of OpenTelemetry. |
not reported | — | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-77360 oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere t... |
not reported | — | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-75516 The RabbitMQ Java client library allows Java and JVM-based applications to conne... |
not reported | — | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-59823 LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) fo... |
not reported | — | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-92627 A heap-use-after-free vulnerability exists in H5T__conv_f_f() in src/H5Tconv.c i... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92571 Rejected reason: CVE ID reserved in error and not assigned to a vulnerability. |
not reported | — | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-82410 Pocketbase is an open source web backend written in go. |
not reported | — | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-77409 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. |
not reported | — | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-77410 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-77411 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-77412 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-77406 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-77407 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-77408 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-77404 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-77405 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. |
not reported | — | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-77403 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-85104 In Sooma 2GEN brain stimulator, an attacker within Bluetooth range can make unau... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-73177 Nozomi Networks Labs identified a CWE-345: Insufficient Verification of Data Aut... |
not reported | — | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-61598 djust provides Phoenix LiveView-style reactive server-side rendering for Django... |
not reported | — | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-88817 An authenticated, non-guest user of Curiosity Workspace could enroll themselves... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-73175 Nozomi Networks Labs identified a CWE-400: Uncontrolled Resource Consumption vul... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-73176 Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Ele... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-73169 Nozomi Networks Labs identified a CWE-79: Improper Neutralization of Input Durin... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.