September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-80934 In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76:... |
not reported | — | — | — | 2026-09-11 | 2026-10-19 |
| CVE-2026-80927 In the Linux kernel, the following vulnerability has been resolved:
timekeeping... |
not reported | — | — | — | 2026-09-11 | 2026-10-19 |
| CVE-2026-80930 In the Linux kernel, the following vulnerability has been resolved:
tpm: tpm_i2... |
not reported | — | — | — | 2026-09-11 | 2026-10-19 |
| CVE-2026-78546 Out-of-bounds read vulnerability in Citirx Workspace app for Windows. |
not reported | — | — | — | 2026-09-11 | 2026-09-16 |
| CVE-2026-78547 Out-of-bounds write vulnerability in Citrix Citrix Workspace app for Windows. |
not reported | — | — | — | 2026-09-11 | 2026-09-16 |
| CVE-2026-87910 When tarfile extracts a link on a system that doesn't support links, it falls ba... |
not reported | — | — | — | 2026-09-11 | 2026-10-22 |
| CVE-2026-81908 Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in the... |
not reported | — | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-81909 Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the block... |
not reported | — | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-68528 Concrete CMS RSS Displayer block below version 9.5.3 rendered remote feed item t... |
not reported | — | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-18122 Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Ex... |
not reported | — | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-54047 Laci Synchroni is a decentralized mod and appearance sync server and plugin for... |
not reported | — | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-81861 CWE-522: Insufficiently Protected Credentials vulnerability that could result in... |
not reported | — | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-87122 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-3869 CWE-303 : Incorrect Implementation of Authentication Algorithm vulnerability exi... |
not reported | — | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-87983 An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.... |
not reported | — | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-87984 An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3... |
not reported | — | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-87985 An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to... |
not reported | — | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-87986 An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to... |
not reported | — | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-87987 An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to... |
not reported | — | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-87988 An arbitrary file access vulnerability in Mistral Vibe allows an attacker to byp... |
not reported | — | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-85979 Affected versions of Puppet Enterprise contain a command injection vulnerability... |
not reported | — | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-15710 An information leakage vulnerability exists in the Endpoint DLP component (epdlp... |
not reported | — | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-47839 A vulnerability allows users authenticating through a federated OIDC provider to... |
not reported | — | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2025-15679 Under certain circumstances such as reset to factory default operation, the BMC... |
not reported | — | — | — | 2026-09-11 | 2026-10-14 |
| CVE-2026-19486 A Server-Side Request Forgery (SSRF) vulnerability in Google Cloud Gemini Enterp... |
not reported | — | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-13326 An out-of-bounds read in Qt NFC's language code length parsing allows a physical... |
not reported | — | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-89169 live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-sign... |
not reported | — | — | — | 2026-09-11 | 2026-09-22 |
| CVE-2026-88260 Authentication bypass using an alternate path or channel and Improper validation... |
not reported | — | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-84941 An information disclosure vulnerability in the SAML Single Sign-On (SSO) functio... |
not reported | — | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-81905 Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes (em... |
not reported | — | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-81906 Concrete CMS OAuth callback login path prior to version 9.5.3 did not check whet... |
not reported | — | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-18121 Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass (IDOR) bec... |
not reported | — | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-17176 An OS
command injection vulnerability in the TDDP module of Deco BE11000 and Dec... |
not reported | — | — | — | 2026-09-11 | 2026-10-01 |
| CVE-2026-16174 Netskope was notified about a potential gap in Netskope Endpoint DLP (EPDLP) run... |
not reported | — | — | — | 2026-09-10 | 2026-09-18 |
| CVE-2026-16172 Netskope was notified of an out-of-bounds heap read affecting the Endpoint DLP (... |
not reported | — | — | — | 2026-09-10 | 2026-09-18 |
| CVE-2026-9768 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-10 | 2026-10-16 |
| CVE-2026-49836 psd-tools is a Python package for working with Adobe Photoshop PSD files. |
not reported | — | — | — | 2026-09-10 | 2026-09-30 |
| CVE-2026-57844 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-10 | 2026-10-15 |
| CVE-2026-76653 A missing
authentication vulnerability in the VPN configuration management has b... |
not reported | — | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-76652 An
authenticated directory traversal vulnerability in file upload functionality... |
not reported | — | — | — | 2026-09-10 | 2026-09-11 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.