September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-73170 Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-73171 Nozomi Networks Labs identified a CWE-73: External Control of File Name or Path... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-73172 Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Ele... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-73173 Nozomi Networks Labs identified a CWE-306: Missing Authentication for Critical F... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-73174 Nozomi Networks Labs identified a CWE-319: Cleartext Transmission of Sensitive I... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-73163 Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Ele... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-73164 Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Ele... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-73165 Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Ele... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-73166 Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-73167 Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Ele... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-19535 Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vul... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-58147 WNC T-Mobile 5G Box IDU router contains an OS command injection vulnerability in... |
not reported | — | — | — | 2026-09-16 | 2026-09-28 |
| CVE-2026-58146 WNC T-Mobile 5G Box IDU router is vulnerable to OS command injection vulnerabili... |
not reported | — | — | — | 2026-09-16 | 2026-09-28 |
| CVE-2026-40854 WNC T-Mobile 5G Box IDU router contains an authentication bypass vulnerability i... |
not reported | — | — | — | 2026-09-16 | 2026-09-28 |
| CVE-2026-40855 WNC T-Mobile 5G Box IDU router is vulnerable to a command injection. |
not reported | — | — | — | 2026-09-16 | 2026-09-28 |
| CVE-2026-40856 WNC T-Mobile 5G Box IDU router is vulnerable to improper access control. |
not reported | — | — | — | 2026-09-16 | 2026-09-28 |
| CVE-2026-40857 WNC T-Mobile 5G Box IDU router contains a cross-site request forgery (CSRF) vuln... |
not reported | — | — | — | 2026-09-16 | 2026-09-28 |
| CVE-2026-90039 In the Linux kernel, the following vulnerability has been resolved:
NFSD: Guard... |
not reported | — | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-90040 In the Linux kernel, the following vulnerability has been resolved:
KVM: SEV: F... |
not reported | — | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-90031 In the Linux kernel, the following vulnerability has been resolved:
usb-storage... |
not reported | — | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-90033 In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-a... |
not reported | — | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-90034 In the Linux kernel, the following vulnerability has been resolved:
usb: image:... |
not reported | — | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-90035 In the Linux kernel, the following vulnerability has been resolved:
drm/amd/dis... |
not reported | — | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-90021 In the Linux kernel, the following vulnerability has been resolved:
usb: gadget... |
not reported | — | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-90023 In the Linux kernel, the following vulnerability has been resolved:
usb: gadget... |
not reported | — | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-90024 In the Linux kernel, the following vulnerability has been resolved:
usb: gadget... |
not reported | — | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-90028 In the Linux kernel, the following vulnerability has been resolved:
usb: typec:... |
not reported | — | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-90029 In the Linux kernel, the following vulnerability has been resolved:
usb: storag... |
not reported | — | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-90015 In the Linux kernel, the following vulnerability has been resolved:
xhci: fix l... |
not reported | — | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-90019 In the Linux kernel, the following vulnerability has been resolved:
usb: gadget... |
not reported | — | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-90020 In the Linux kernel, the following vulnerability has been resolved:
USB: gadget... |
not reported | — | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-90005 In the Linux kernel, the following vulnerability has been resolved:
samples/dam... |
not reported | — | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-90006 In the Linux kernel, the following vulnerability has been resolved:
samples/dam... |
not reported | — | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-90004 In the Linux kernel, the following vulnerability has been resolved:
mm/damon/co... |
not reported | — | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-8462 SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter befo... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-89989 In the Linux kernel, the following vulnerability has been resolved:
ima: Check... |
not reported | — | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89991 In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix in... |
not reported | — | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89993 In the Linux kernel, the following vulnerability has been resolved:
dmaengine:... |
not reported | — | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89996 In the Linux kernel, the following vulnerability has been resolved:
dma-buf: dm... |
not reported | — | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-89981 In the Linux kernel, the following vulnerability has been resolved:
arm64: Don'... |
not reported | — | — | — | 2026-09-16 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.