September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-80917 In the Linux kernel, the following vulnerability has been resolved:
PCI: host-g... |
not reported | — | — | — | 2026-09-09 | 2026-10-19 |
| CVE-2026-80918 In the Linux kernel, the following vulnerability has been resolved:
HID: core:... |
not reported | — | — | — | 2026-09-09 | 2026-10-19 |
| CVE-2026-77120 CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS C... |
not reported | — | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-56125 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-09 | 2026-10-16 |
| CVE-2026-43635 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-09 | 2026-10-16 |
| CVE-2026-43645 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-09 | 2026-10-16 |
| CVE-2026-47156 MantisBT is an open source bug tracker. |
not reported | — | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-49947 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-09 | 2026-10-16 |
| CVE-2026-26350 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-09 | 2026-10-16 |
| CVE-2026-28523 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-09 | 2026-10-16 |
| CVE-2026-34412 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-09 | 2026-10-16 |
| CVE-2026-24442 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-09 | 2026-10-16 |
| CVE-2026-19233 CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could caus... |
not reported | — | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-67403 Cash Collect contains an improper authorization vulnerability in the Sage AR Aut... |
not reported | — | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-68484 Cash Collect contains an improper authorization vulnerability in the Sage AR Aut... |
not reported | — | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-64857 tirreno, a security framework, has a session fixation issue in versions prior to... |
not reported | — | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-15140 A privilege-escalation issue in the Portworx Operator when deployed on Red Hat O... |
not reported | — | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-87827 Certain KGUARD DVR devices running vulnerable firmware expose a system command e... |
not reported | — | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2025-3271 Documentum Webtop versions prior to 16.7.1 software is vulnerable to an XSS |
not reported | — | — | — | 2026-09-09 | 2026-10-19 |
| CVE-2026-79696 A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit... |
not reported | — | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-12858 Improper Privilege Management vulnerability in ESET AV Remover (standalone) allo... |
not reported | — | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-15398 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-09-09 | 2026-10-16 |
| CVE-2025-7062 A stored cross-site scripting (XSS) vulnerability has been identified in the H5P... |
not reported | — | — | — | 2026-09-09 | 2026-10-19 |
| CVE-2026-21106 Improper verification of intent by broadcast receiver in Samsung Cloud Assistant... |
not reported | — | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-21109 Improper access control in Watch Plugin prior to Android Watch 17 allows local a... |
not reported | — | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-21110 Out-of-bounds write in libsavscmn.so prior to One UI 8.5 allows local attackers... |
not reported | — | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-21111 Out-of-bounds write in libsthmbc.so prior to One UI 8.5 allows local attackers t... |
not reported | — | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-55250 Maravel, a PHP framework oriented towards dependency injection, prior to version... |
not reported | — | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-47680 The source-controller is a Kubernetes operator, specialised in artifacts acquisi... |
not reported | — | — | — | 2026-09-08 | 2026-09-30 |
| CVE-2026-53639 Sylius is an Open Source eCommerce Framework on Symfony. |
not reported | — | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-86081 n8n is an open source workflow automation platform. |
not reported | — | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-81904 Concrete CMS below 9.5.3 registered view assets for every sub-block of a Stack,... |
not reported | — | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-53933 Maravel, a PHP framework oriented towards dependency injection, prior to version... |
not reported | — | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-49153 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-08 | 2026-10-16 |
| CVE-2026-49154 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-08 | 2026-10-16 |
| CVE-2026-49155 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-08 | 2026-10-16 |
| CVE-2026-49156 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-08 | 2026-10-16 |
| CVE-2026-7809 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-08 | 2026-10-16 |
| CVE-2026-45219 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-08 | 2026-10-16 |
| CVE-2026-45220 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-08 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.