September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-89824 In the Linux kernel, the following vulnerability has been resolved:
drm/panel-e... |
not reported | — | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89820 In the Linux kernel, the following vulnerability has been resolved:
drm/amd/dis... |
not reported | — | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89821 In the Linux kernel, the following vulnerability has been resolved:
drm/amd/dis... |
not reported | — | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89822 In the Linux kernel, the following vulnerability has been resolved:
drm/i915: G... |
not reported | — | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89809 In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd:... |
not reported | — | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89812 In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu:... |
not reported | — | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-89813 In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu:... |
not reported | — | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-89816 In the Linux kernel, the following vulnerability has been resolved:
drm: Fix dr... |
not reported | — | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89817 In the Linux kernel, the following vulnerability has been resolved:
drm/gud: NU... |
not reported | — | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89802 In the Linux kernel, the following vulnerability has been resolved:
drm/nouveau... |
not reported | — | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-89807 In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd:... |
not reported | — | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-86585 The lack of signature verification of firmware update packages in VEO and VEO-XS... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-89794 In the Linux kernel, the following vulnerability has been resolved:
ksmbd: zero... |
not reported | — | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-89796 In the Linux kernel, the following vulnerability has been resolved:
mm/damon/co... |
not reported | — | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89797 In the Linux kernel, the following vulnerability has been resolved:
power: supp... |
not reported | — | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89798 In the Linux kernel, the following vulnerability has been resolved:
rpcrdma: ar... |
not reported | — | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89800 In the Linux kernel, the following vulnerability has been resolved:
drm/nouveau... |
not reported | — | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-14916 A JWT signature verification vulnerability affects Kong components that perform... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-86443 Cleartext storage of sensitive information in the DuoxMe application for Android... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-86474 The lack of TLS certificate validation when downloading firmware updates in VEO... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-85628 Transmission of the home Wi-Fi credentials without encryption during the pairing... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-76151 Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-14917 A SAML authentication bypass vulnerability affects the Kong SAML plugin when the... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-89784 In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: che... |
not reported | — | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89785 In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: f... |
not reported | — | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89787 In the Linux kernel, the following vulnerability has been resolved:
ext4: check... |
not reported | — | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89790 In the Linux kernel, the following vulnerability has been resolved:
ipv6: avoid... |
not reported | — | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89780 In the Linux kernel, the following vulnerability has been resolved:
net: qualco... |
not reported | — | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-88255 Improper Validation of Unsafe Equivalence in Input in ZenHive mpp allows an unau... |
not reported | — | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-89186 Use of Cache Containing Sensitive Information in ZenHive mpp allows a shared HTT... |
not reported | — | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-89776 In the Linux kernel, the following vulnerability has been resolved:
vxlan: vnif... |
not reported | — | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-86338 Ash field_policies are documented to protect against filter-based information di... |
not reported | — | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-92355 In affected versions of Octopus Server, a user with permission to modify non bui... |
not reported | — | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-19248 QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-servi... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-61396 Rejected reason: Did not need CVE ID |
not reported | — | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-15639 An attacker can craft a malicious link that, if used by a legitimate user, may c... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-15640 Under certain conditions a valid SAML IdP response may be used to impersonate an... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-15638 An unauthenticated user with access to Secret Server could leverage a padding or... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-10145 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-15 | 2026-10-16 |
| CVE-2026-10149 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-15 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.