September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84830 SEPPmail Secure Email Gateway before 15.0.7 contains a command injection vulnera... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84831 SEPPmail Secure Email Gateway before 15.0.7 creates a fully privileged session b... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84832 SEPPmail Secure Email Gateway before 15.0.6 deserializes attacker-controlled dat... |
not reported | — | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-80755 In the Linux kernel, the following vulnerability has been resolved:
selinux: re... |
not reported | — | — | — | 2026-09-03 | 2026-10-21 |
| CVE-2026-80756 In the Linux kernel, the following vulnerability has been resolved:
selinux: do... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-80757 In the Linux kernel, the following vulnerability has been resolved:
selinux: re... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-80746 In the Linux kernel, the following vulnerability has been resolved:
clk: qcom:... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-80739 In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e:... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-80740 In the Linux kernel, the following vulnerability has been resolved:
drm/log: Fi... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-80742 In the Linux kernel, the following vulnerability has been resolved:
af_packet:... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-80743 In the Linux kernel, the following vulnerability has been resolved:
ASoC: xilin... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-80744 In the Linux kernel, the following vulnerability has been resolved:
netfilter:... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-80733 In the Linux kernel, the following vulnerability has been resolved:
net: remove... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-80726 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-03 | 2026-10-20 |
| CVE-2026-80727 In the Linux kernel, the following vulnerability has been resolved:
x86/mce: Se... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-80728 In the Linux kernel, the following vulnerability has been resolved:
Revert "drm... |
not reported | — | — | — | 2026-09-03 | 2026-09-29 |
| CVE-2026-80729 In the Linux kernel, the following vulnerability has been resolved:
mm/huge_mem... |
not reported | — | — | — | 2026-09-03 | 2026-10-11 |
| CVE-2026-80730 In the Linux kernel, the following vulnerability has been resolved:
ring-buffer... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-78064 Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherite... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-78065 Joomla Extension - j2commerce.com - Guest checkout address disclosure to any aut... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-78069 Joomla Extension - j2commerce.com - Missing authorization on Apps controller del... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-78080 Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Li... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-78304 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-03 | 2026-10-16 |
| CVE-2026-76176 SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admin... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-76177 Server-Side Request Forgery (SSRF) vulnerability in the /ocsreports/?function=te... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-76178 A stored Cross-Site Scripting (XSS) vulnerability in the notification template f... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-77999 Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery lead... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-78000 Joomla Extension - j2commerce.com - Reflected XSS via `filter_tag`, `pricefrom`... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-76174 Unrestricted file upload vulnerability in the CSV file upload functionality of t... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-76175 SQL injection vulnerability in the del_check parameter of the /ocsreports/?funct... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-15926 Rejected reason: Red Hat Product Security has determined that this CVE ID is not... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-15933 OptimiDoc Server (On-Premise) stores credentials for external services in cleart... |
not reported | — | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-66048 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-03 | 2026-10-16 |
| CVE-2026-66049 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-03 | 2026-10-16 |
| CVE-2026-84452 Windows ML CLI is a command line tool for building portable, performant, and hig... |
not reported | — | — | — | 2026-09-02 | 2026-09-28 |
| CVE-2026-53670 PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation L... |
not reported | — | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-53671 PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation L... |
not reported | — | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-53706 PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation L... |
not reported | — | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-49249 Boruta is a standalone authorization server that aims to implement OAuth 2.0 and... |
not reported | — | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-79756 Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. |
not reported | — | — | — | 2026-09-02 | 2026-09-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.