September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86464 In the current development version of Eclipse aeriOS, for which no official rele... |
not reported | — | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-84197 In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-... |
not reported | — | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-86477 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-85384 A stack-based buffer overflow vulnerability exists in the httpd component of RE2... |
not reported | — | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-79721 Code execution can occur in versions of the MLflow platform running version 0.0.... |
not reported | — | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-82514 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-08 | 2026-10-16 |
| CVE-2026-81531 An information
disclosure vulnerability has been identified in Omada Controller. |
not reported | — | — | — | 2026-09-08 | 2026-09-21 |
| CVE-2026-78216 AshLua exposes Ash read actions to Lua scripts run through an eval action. |
not reported | — | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-78230 AshAi exposes Ash read actions to language-model tool calls. |
not reported | — | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-16769 An unencrypted 'pause encryption request' message causes a denial of service in... |
not reported | — | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86135 A Cross-Site Request Forgery (CSRF) vulnerability in WatchGuard Dimension's data... |
not reported | — | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-70613 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-08 | 2026-10-16 |
| CVE-2026-70614 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-08 | 2026-10-16 |
| CVE-2026-33197 AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause th... |
not reported | — | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-19203 A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server... |
not reported | — | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-11573 Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path... |
not reported | — | — | — | 2026-09-08 | 2026-09-11 |
| CVE-2026-12611 A client may issue HTTP/2 requests to a Jetty server that result in blocking wri... |
not reported | — | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-80219 Rejected reason: Red Hat Product Security has come to the conclusion that this C... |
not reported | — | — | — | 2026-09-08 | 2026-09-21 |
| CVE-2026-77654 Improper Privilege Management vulnerability in Horizon Security Analyzer (former... |
not reported | — | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-19614 The API is prone to XML external entity (XXE) injection. |
not reported | — | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-85400 Backend administrators without system maintainer privileges were able to schedul... |
not reported | — | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86590 In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /da... |
not reported | — | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-77132 It has been discovered that several AJAX routes used for the backend localizatio... |
not reported | — | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-75811 Improper Restriction of Software Interfaces to Hardware Features in ASUS Armoury... |
not reported | — | — | — | 2026-09-08 | 2026-09-28 |
| CVE-2026-18023 Sensitive Information in Resource Not Removed Before Reuse in ASUS Armoury Crate... |
not reported | — | — | — | 2026-09-08 | 2026-09-28 |
| CVE-2026-19397 Missing authentication for a critical function in ASUS Control Center Express Ag... |
not reported | — | — | — | 2026-09-08 | 2026-09-28 |
| CVE-2026-75808 Allocation of Resources Without Limits or Throttling in ASUS Armoury Crate allow... |
not reported | — | — | — | 2026-09-08 | 2026-09-28 |
| CVE-2026-75809 Exposed IOCTL with insufficient access control in ASUS Armoury Crate allows a lo... |
not reported | — | — | — | 2026-09-08 | 2026-09-28 |
| CVE-2026-75810 Exposed Dangerous Method or Function in ASUS Armoury Crate allow a local user to... |
not reported | — | — | — | 2026-09-08 | 2026-09-28 |
| CVE-2026-12962 A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crat... |
not reported | — | — | — | 2026-09-08 | 2026-09-17 |
| CVE-2026-16003 Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a... |
not reported | — | — | — | 2026-09-08 | 2026-09-17 |
| CVE-2026-16004 Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a... |
not reported | — | — | — | 2026-09-08 | 2026-09-17 |
| CVE-2026-16005 Release of Invalid Pointer or Reference in Armoury Crate driver allows a local u... |
not reported | — | — | — | 2026-09-08 | 2026-09-17 |
| CVE-2026-16006 Exposure of Sensitive System Information to an Unauthorized Control Sphere in Ar... |
not reported | — | — | — | 2026-09-08 | 2026-09-17 |
| CVE-2026-82710 Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in a... |
not reported | — | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-82758 Improper Authentication vulnerability in ash-project ash_authentication_oauth2_s... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-82586 Improper Protection of Alternate Path vulnerability in ash-project ash_lua allow... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-82753 Allocation of Resources Without Limits or Throttling vulnerability in ash-projec... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-82754 Improper Protection of Alternate Path vulnerability in ash-project ash_authentic... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-82755 Use of Cache Containing Sensitive Information vulnerability in ash-project ash_a... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.