September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-80765 In the Linux kernel, the following vulnerability has been resolved:
HID: hyperv... |
not reported | — | — | — | 2026-09-04 | 2026-10-19 |
| CVE-2026-80766 In the Linux kernel, the following vulnerability has been resolved:
HID: uclogi... |
not reported | — | — | — | 2026-09-04 | 2026-10-19 |
| CVE-2026-80758 In the Linux kernel, the following vulnerability has been resolved:
futex: Avoi... |
not reported | — | — | — | 2026-09-04 | 2026-10-19 |
| CVE-2026-80759 In the Linux kernel, the following vulnerability has been resolved:
Bluetooth:... |
not reported | — | — | — | 2026-09-04 | 2026-10-19 |
| CVE-2026-82729 Inefficient Algorithmic Complexity vulnerability in elixir-mint mint allows a re... |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-82728 Allocation of Resources Without Limits or Throttling vulnerability in elixir-min... |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85591 phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in... |
not reported | — | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-85588 phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext wit... |
not reported | — | — | — | 2026-09-04 | 2026-09-14 |
| CVE-2026-85589 phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in... |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85590 phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two... |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85586 phpMyFAQ versions before 4.1.8 fail to validate CAPTCHA when the store parameter... |
not reported | — | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-85587 phpMyFAQ before 4.1.8 enforces incorrect permission checks on admin content page... |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-79707 A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Dev... |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-4644 A Missing Authorization vulnerability in HTTP Connector in Google Cloud Integrat... |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85546 MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing g... |
not reported | — | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-85547 A cross-site request forgery (CSRF) vulnerability exists in MISP due to form-sec... |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-13148 Missing release of memory after effective lifetime vulnerability in Softing smar... |
not reported | — | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-85533 An authorization flaw in MISP allowed an authenticated user to submit a sharing_... |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85538 An incorrect authorization vulnerability in MISP allowed authenticated users to... |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-15937 Improper certificate validation in Checkmk <2.5.0p10 allows a relay and a push a... |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-15354 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-09-04 | 2026-10-16 |
| CVE-2026-75754 Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF)... |
not reported | — | — | — | 2026-09-04 | 2026-09-17 |
| CVE-2026-67397 Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allo... |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-67398 Missing authorization vulnerability has been discovered in 2Checkout payment gat... |
not reported | — | — | — | 2026-09-04 | 2026-09-14 |
| CVE-2026-67402 An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/b... |
not reported | — | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-18167 A
stack-based buffer overflow vulnerability exists in the EasyMesh module of
TP-... |
not reported | — | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-18330 A hard-coded
cryptographic key vulnerability exists in the web module of TP-Link... |
not reported | — | — | — | 2026-09-03 | 2026-10-27 |
| CVE-2026-85458 Divide-by-zero in Xpdf 4.06 (and earlier), when a glyph in a Type 3 font has a z... |
not reported | — | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85062 Colord is a tiny yet powerful tool for high-performance color manipulations and... |
not reported | — | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-85063 node-csv is a full-featured CSV parser with a simple API that is tested against... |
not reported | — | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-15431 A potential security vulnerability has been identified in the HP Support
Assist... |
not reported | — | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85242 PlaywrightCapture contains a server-side request forgery (SSRF) vulnerability in... |
not reported | — | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-84736 In the current development version of Eclipse aeriOS, for which no official rele... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-57445 Gardens v2 is a modular governance framework that enables communities to create... |
not reported | — | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-53720 pymonocypher uses cython to wrap the Monocypher C library. |
not reported | — | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-53924 Gardens v2 is a modular governance framework that enables communities to create... |
not reported | — | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-85199 Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversa... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-82180 In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled w... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-80515 In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization g... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-6071 A remote code execution security issue exists in the affected products when pars... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.