September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84147 This vulnerability exists in the ERP system due to improper authentication contr... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-84148 This vulnerability exists in the ERP system due to improper authentication and a... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-19471 Multiple stored cross-site scripting security issues exist within ArmorStart® LT... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-19472 A denial-of-service security issue exists within ArmorStart® LT. |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-84194 LibreNMS versions >= 23.10.0 and < 26.2.0 (fixed in 26.4.0) contain an authentic... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84193 LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84165 A vulnerability relating to incorrect access control in OpenNebula by OpenNebula... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-4813 A vulnerability in the Lutece Core XSL export management module up to version 7.... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-78319 A service running on the affected products contains a potential Time-of-Check Ti... |
not reported | — | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-82747 Incorrect Authorization vulnerability in ash-project ash returns records that a... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82748 Incorrect Authorization vulnerability in ash-project ash authorizes an aggregate... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82749 Incorrect Authorization vulnerability in ash-project ash widens a relationship's... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82742 Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attac... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82743 Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow a... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82744 Not Failing Securely (Failing Open) vulnerability in ash-project ash skips an As... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82745 Improper Access Control vulnerability in ash-project ash lets a create action ov... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82746 Missing Authorization vulnerability in ash-project ash allows an actor to update... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82736 Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-proj... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82737 Integer Overflow or Wraparound vulnerability in ash-project ash lets an attacker... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82738 Improper Input Validation vulnerability in ash-project ash allows an attacker to... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82739 Generation of Error Message Containing Sensitive Information vulnerability in as... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82740 Improper Input Validation vulnerability in ash-project ash fails to enforce the... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82741 Improper Validation of Specified Type of Input vulnerability in ash-project ash... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82734 Improper Validation of Specified Quantity in Input vulnerability in ash-project... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82735 Uncontrolled Resource Consumption vulnerability in ash-project ash allows an att... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82732 Improper Input Validation vulnerability in ash-project ash_typescript allows a r... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82733 Generation of Error Message Containing Sensitive Information vulnerability in as... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82730 Incorrect Authorization vulnerability in ash-project ash_typescript allows an un... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82731 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ash-project... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-74837 Allocation of Resources Without Limits or Throttling vulnerability in ash-projec... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-77856 Allocation of Resources Without Limits or Throttling vulnerability in ash-projec... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-77950 Generation of Error Message Containing Sensitive Information vulnerability in as... |
not reported | — | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-67394 A critical local privilege escalation via OS command injection vulnerability has... |
not reported | — | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-19820 A vulnerability in the Backblaze Client allows a local user to make the system n... |
not reported | — | — | — | 2026-09-01 | 2026-09-11 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.