September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-10150 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-15 | 2026-10-16 |
| CVE-2026-68491 An insufficient check allowed for the overwrite of arbitrary files via a symlink... |
not reported | — | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-79994 The guest-to-host Unix-domain socket relay in Docker Sandboxes validates that a... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-76821 OpenCTI is an open source platform for managing cyber threat intelligence knowle... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-61544 libp2p-rust is the official Rust language implementation of the libp2p networkin... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-32599 Netmaker makes networks with WireGuard. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-82190 Joomla Extension - j2commerce.com - Predictable/forgeable order access token in... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-82191 Joomla Extension - j2commerce.com - Unescaped request data reflected into PayPal... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-84048 Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file uploa... |
not reported | — | — | — | 2026-09-15 | 2026-09-19 |
| CVE-2026-81568 Joomla Extension - j2commerce.com - Arbitrary file read via `task=download` in J... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-82189 Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-81567 Joomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the s... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-78081 Joomla Extension - j2commerce.com - Missing CSRF protection on cart, checkout an... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-68532 Concrete CMS 9.0.0 to dashboard group type controller did not validate a CSRF to... |
not reported | — | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-68533 Concrete CMS below 9.5.3 conversation attachment uploaded endpoint imported file... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-68534 Concrete CMS before 9.5.3 rendered Express entry labels as raw HTML when display... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-69204 Http4s is a Scala interface for HTTP services. |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-66789 Rejected reason: This CVE ID was assigned in error as a duplicate of CVE-2026-70... |
not reported | — | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-66790 Rejected reason: This CVE ID was assigned in error as a duplicate of CVE-2026-70... |
not reported | — | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-68529 Concrete CMS 9.0.0 through 9.5.2 was missing an authorization check on the Expre... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-68530 Concrete CMS 9 through 9.5.2 did not perform an authorization check on several b... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-68531 Concrete CMS 9 before 9.5.3 did not escape SQL LIKE wildcard characters in the k... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-18421 Concrete CMS 9 through 9.5.2 does not perform an authorization check in three ac... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-81898 In Concrete CMS below version 9.5.3, the Address attribute's country-less text f... |
not reported | — | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-81899 Concrete CMS 9.0.0 to 9.5.2 stored group folder names without sanitization and p... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-58502 githubtoplanguages generates a user's top GitHub languages as an SVG. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-57441 MCPVault is a lightweight Model Context Protocol server for safe access to files... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-57442 MCPVault is a lightweight Model Context Protocol server for safe access to files... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-53459 Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D p... |
not reported | — | — | — | 2026-09-15 | 2026-09-29 |
| CVE-2026-53941 Inspektor Gadget is a set of tools and framework for data collection and system... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54251 netty-incubator-codec-ohttp implements Oblivious HTTP (OHTTP) gateway and client... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-44300 OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-18113 In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape d... |
not reported | — | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-18115 Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field edit_user_properties permi... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-58201 Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-53658 Fabric CA is a Certificate Authority for Hyperledger Fabric. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-46488 motionEye (mEye) is an online interface for a piece of software called "motion,"... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-44778 Inspektor Gadget is a set of tools and framework for data collection and system... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-21588 This High severity DoS (Denial of Service) vulnerability was introduced in versi... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-21586 This High severity Improper Authorization vulnerability was introduced in versio... |
not reported | — | — | — | 2026-09-15 | 2026-09-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.