September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-88061 career-ops is an open-source AI-assisted job search and application management t... |
not reported | — | — | — | 2026-09-10 | 2026-09-30 |
| CVE-2026-88062 OmniRoute is an open-source AI gateway providing a single endpoint for multiple... |
not reported | — | — | — | 2026-09-10 | 2026-09-30 |
| CVE-2026-84432 Concrete CMS 9 through 9.5.2 did not validate an anti-CSRF token in the Boards c... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-68527 Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authorization byp... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-15417 In the silabser.sys Windows 8 driver for CP210x devices, a local unprivileged us... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-15418 In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unpri... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-15419 In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unpri... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-65638 Improper escaping of a request URL in ConfigServer Security & Firewall allows an... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-65639 OS command injection in the advanced-rule parser of ConfigServer Security & Fire... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88915 Affected versions of MISP do not consistently enforce the acting user's authoriz... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88921 MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterToo... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-17038 DrEryk Gabinet before 11.5.0 uses hard-coded API credentials in its ticket repor... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-78085 Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management i... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-78083 Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-78084 Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Mana... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-78302 Joomla Extension - joomshaper.com - Unauthenticated Stored Cross-Site Scripting... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-78303 Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipul... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-78374 Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-78082 Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Se... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-13745 A vulnerability in the Gemini CLI prior to version 0.39.1 allows attackers to ac... |
not reported | — | — | — | 2026-09-10 | 2026-09-23 |
| CVE-2026-87804 Rejected reason: no security impact |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-0303 A code execution vulnerability in Palo Alto Networks Checkov by Prisma® Cloud ca... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-0304 A privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM... |
not reported | — | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-0302 An OS command injection vulnerability in Palo Alto Networks Checkov by Prisma® C... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-0310 A buffer overflow vulnerability in the XML processing functionality of Palo Alto... |
not reported | — | — | — | 2026-09-10 | 2026-10-15 |
| CVE-2026-0306 A vulnerability in the EndPoint Data Loss Prevention (DLP) enforcement of Palo A... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-0307 Multiple local privilege escalation vulnerabilities in the Palo Alto Networks Gl... |
not reported | — | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-0308 A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS®... |
not reported | — | — | — | 2026-09-10 | 2026-10-15 |
| CVE-2026-0309 A command injection vulnerability in Palo Alto Networks PAN-OS® software enables... |
not reported | — | — | — | 2026-09-10 | 2026-10-15 |
| CVE-2026-0305 An information disclosure vulnerability in the Palo Alto Networks Prisma® Access... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88069 Pandora contains a path traversal vulnerability in its archive extraction worker... |
not reported | — | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-50165 alf.io is an open source ticket reservation system for conferences, trade shows,... |
not reported | — | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-8044 CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument I... |
not reported | — | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-80919 In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu:... |
not reported | — | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-80920 In the Linux kernel, the following vulnerability has been resolved:
io_uring: d... |
not reported | — | — | — | 2026-09-09 | 2026-10-21 |
| CVE-2026-80922 In the Linux kernel, the following vulnerability has been resolved:
crypto: qco... |
not reported | — | — | — | 2026-09-09 | 2026-10-19 |
| CVE-2026-80923 In the Linux kernel, the following vulnerability has been resolved:
xhci: dbgtt... |
not reported | — | — | — | 2026-09-09 | 2026-10-19 |
| CVE-2026-80925 In the Linux kernel, the following vulnerability has been resolved:
vlan: fix s... |
not reported | — | — | — | 2026-09-09 | 2026-10-19 |
| CVE-2026-80915 In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Fix... |
not reported | — | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-80916 In the Linux kernel, the following vulnerability has been resolved:
kcov: fix d... |
not reported | — | — | — | 2026-09-09 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.