September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-82756 Improper Encoding or Escaping of Output vulnerability in ash-project ash_authent... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-82757 Server-Side Request Forgery (SSRF) vulnerability in ash-project ash_authenticati... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-81638 Improper Handling of Alternate Encoding vulnerability in ash-project ash_double_... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-82584 Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in a... |
not reported | — | — | — | 2026-09-07 | 2026-09-28 |
| CVE-2026-78325 Cross-site scripting in the Evernote and Google Keep note importers in Standard... |
not reported | — | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-82325 A use-after-free vulnerability in the OpenVPN ovpn-dco-win driver version 2.5.0... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-85201 In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the le... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-19204 A client may send a WebSocket frame with an unknown opcode and a very large decl... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-84173 In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interf... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-84186 Vulnerability involving incorrect access control in the Tools::getRemoteAddr() f... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-84732 Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remot... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-14297 A buffer overflow in the Bluetooth Continuous Glucose
Monitoring Service (CGMS)... |
not reported | — | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-18796 Any application that
uses external QSPI flash for encrypted XIP on nRF5340 and... |
not reported | — | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-81738 OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows atta... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-81830 The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local aut... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-82312 OpenVPN 2.0.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows loca... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-84226 OpenVPN version 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows all... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-84256 An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 thro... |
not reported | — | — | — | 2026-09-07 | 2026-10-13 |
| CVE-2026-78043 The Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-78221 An incorrect buffer size calculation in the Windows Interactive Service in OpenV... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-16876 An authentication bypass vulnerability exists in the WebGUI of Series UNIVERGE I... |
not reported | — | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-82751 Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unau... |
not reported | — | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-82750 Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unau... |
not reported | — | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86283 MISP's UiBeta theme collection view (app/View/Themed/UiBeta/Collections/view.ctp... |
not reported | — | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-76160 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-05 | 2026-10-16 |
| CVE-2026-76161 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-05 | 2026-10-16 |
| CVE-2026-86206 A vulnerability in the N-central internal API access control filter allows unaut... |
not reported | — | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86207 An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypa... |
not reported | — | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-82752 Improper Validation of Specified Quantity in Input vulnerability in ash-project... |
not reported | — | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86197 Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig san... |
not reported | — | — | — | 2026-09-05 | 2026-10-08 |
| CVE-2026-86193 grav-plugin-api before 1.0.20 fails to validate group-inherited super permission... |
not reported | — | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86194 Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving... |
not reported | — | — | — | 2026-09-05 | 2026-09-18 |
| CVE-2026-86195 grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerabil... |
not reported | — | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86196 Grav API plugin versions before 1.0.20 build password reset links from the untru... |
not reported | — | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-52777 YesWiki is a wiki system written in PHP. |
not reported | — | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-52762 YesWiki is a wiki system written in PHP. |
not reported | — | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-46636 Twig is a template language for PHP. |
not reported | — | — | — | 2026-09-04 | 2026-09-25 |
| CVE-2026-53602 nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-53603 nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-53604 nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.