September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-52820 Kimai is an open-source time tracking application. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-91857 Affected versions of MISP expose several state-changing controller actions witho... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91859 Affected versions of MISP can record incorrect access-log data for requests that... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-47424 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-47426 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-48717 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-53660 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-62263 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-45051 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-45052 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-45794 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-46498 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-46619 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-25 |
| CVE-2026-46623 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-41573 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-44202 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-25 |
| CVE-2026-44203 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-44793 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-91851 Affected versions of MISP incorrectly filter dashboard templates that are restri... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91825 Affected versions of MISP fail to authorize a submitted sharing group in a speci... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91846 Affected versions of MISP allow a collection element to be created from a bare U... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-87730 Rejected reason: this is rejected |
not reported | — | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-76159 Incorrect Permission Assignment for Critical Resource in the configuration loade... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91778 In affected versions of Octopus Server, users with certain scoped permission set... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91819 Affected versions of MISP rely on CakePHP request-method override processing in... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-88261 Improper input validation vulnerability in bizwell xClick allows Stored XSS. |
not reported | — | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-88262 Insufficient session expiration vulnerability in bizwell xClick allows Authentic... |
not reported | — | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-90896 Missing Authentication for Critical Function (CWE-306) in the checkout session l... |
not reported | — | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-67399 Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8... |
not reported | — | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-68489 Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolk... |
not reported | — | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-54559 PocketSphinx is a small speech recognizer. |
not reported | — | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-82049 In CPython 3.13 and earlier, the tarfile module's data and tar extraction filter... |
not reported | — | — | — | 2026-09-14 | 2026-10-11 |
| CVE-2026-77884 Gallery - Private Photo Vault 1.0.41 starts an unauthenticated HTTP server that... |
not reported | — | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2013-1446 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-86836 In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload file... |
not reported | — | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-57577 DotVVM is an open source MVVM framework for web applications. |
not reported | — | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-57578 DotVVM is an open source MVVM framework for web applications. |
not reported | — | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54150 next-video is a library for adding video to Next.js applications. |
not reported | — | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-53495 containerd is an open-source container runtime. |
not reported | — | — | — | 2026-09-14 | 2026-09-25 |
| CVE-2026-49250 Conform, a type-safe form validation library, allows the parsing of nested objec... |
not reported | — | — | — | 2026-09-14 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.