September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84376 Astro is a web framework for content-driven websites. |
not reported | — | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-79754 Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. |
not reported | — | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-53600 async-tar is a tar archive reading/writing library for async Rust. |
not reported | — | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-82955 In the current development version of Eclipse aeriOS, which has not yet had an o... |
not reported | — | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-79989 The vulnerability allows any authenticated user to change their own password wit... |
not reported | — | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-79990 Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIdd... |
not reported | — | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-79991 Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIdd... |
not reported | — | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2024-7956 A vulnerability exists in the affected products that allows a threat actor to ga... |
not reported | — | — | — | 2026-09-02 | 2026-10-27 |
| CVE-2025-13398 Rejected reason: This CVE ID is a duplicate of CVE-2025-13542 and was never publ... |
not reported | — | — | — | 2026-09-02 | 2026-10-07 |
| CVE-2026-82958 In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper... |
not reported | — | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84175 In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of... |
not reported | — | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-23584 Rejected reason: Withdrawn by requester. |
not reported | — | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-23585 Rejected reason: Withdrawn by requester. |
not reported | — | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-23586 Rejected reason: Withdrawn by requester. |
not reported | — | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-23587 Rejected reason: Withdrawn by requester. |
not reported | — | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-23588 Rejected reason: Withdrawn by requester. |
not reported | — | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-23589 Rejected reason: Withdrawn by requester. |
not reported | — | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-23590 Rejected reason: Withdrawn by requester. |
not reported | — | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-23591 Rejected reason: Withdrawn by requester. |
not reported | — | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-23583 Rejected reason: Withdrawn by requester. |
not reported | — | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-19754 Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in t... |
not reported | — | — | — | 2026-09-02 | 2026-10-23 |
| CVE-2026-84481 WWBN AVideo through 30.0 contains an information disclosure vulnerability in the... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84361 Composer is a dependency Manager for the PHP language. |
not reported | — | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-77221 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-01 | 2026-10-16 |
| CVE-2026-77222 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-01 | 2026-10-16 |
| CVE-2026-77223 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-01 | 2026-10-16 |
| CVE-2026-84303 gRPC-Go is the Go language implementation of gRPC. |
not reported | — | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84304 gRPC-Go is the Go language implementation of gRPC. |
not reported | — | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84305 sqlparse is a non-validating SQL parser module for Python. |
not reported | — | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2024-7952 A data exposure vulnerability exists in the affected product. |
not reported | — | — | — | 2026-09-01 | 2026-10-27 |
| CVE-2024-7953 A vulnerability exists in the affected products that allows a threat actor to cr... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-83616 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83617 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83618 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83619 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83610 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83611 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83612 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83613 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83614 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.