September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84842 IBM Guardium Data Protection 12.2 is vulnerable to path traversal and arbitrary... |
high | 8.1 | — | Ibm / guardium data protection | 2026-09-29 | 2026-10-01 |
| CVE-2026-94954 A stack-based buffer overflow vulnerability exists in the web management interfa... |
high | 8.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-95274 Improper output encoding in DevTools in Google Chrome prior to 154.0.8037.57 all... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95276 Improper input validation in Themes in Google Chrome prior to 154.0.8037.57 allo... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-84414 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to chang... |
high | 7.8 | — | Ibm / i | 2026-09-29 | 2026-10-02 |
| CVE-2026-84421 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-29 | 2026-10-02 |
| CVE-2026-84422 IBM Guardium Data Protection 12.2 is vulnerable to command injection in the CLI... |
high | 7.2 | — | Ibm / guardium data protection | 2026-09-29 | 2026-10-02 |
| CVE-2026-84440 IBM Guardium Data Protection 12.2 is vulnerable to command injection in the SNMP... |
high | 8.8 | — | Ibm / guardium data protection | 2026-09-29 | 2026-10-01 |
| CVE-2026-102810 Marmite through 0.4.2 contains a path traversal vulnerability in the development... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102811 Marmite through 0.4.2 contains missing authentication in the development server... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102758 The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-leng... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102728 Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a ser... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102677 Electron is a framework for writing cross-platform desktop applications using Ja... |
high | 8.8 | — | Electronjs / electron | 2026-09-29 | 2026-10-08 |
| CVE-2026-102558 A flaw was found in libsoup. |
high | 8.6 | — | Gnome / libsoup | 2026-09-29 | 2026-10-19 |
| CVE-2026-102559 A flaw was found in libsoup. |
high | 8.6 | — | Gnome / libsoup | 2026-09-29 | 2026-10-19 |
| CVE-2026-102555 A flaw was found in libsoup. |
high | 8.2 | — | Gnome / libsoup | 2026-09-29 | 2026-10-15 |
| CVE-2026-92222 Joomla! |
high | 8.0 | — | Joomla / joomla\! | 2026-09-29 | 2026-10-06 |
| CVE-2026-92227 Joomla! |
high | 7.5 | — | Joomla / joomla\! | 2026-09-29 | 2026-10-06 |
| CVE-2026-90906 Joomla! |
high | 8.3 | — | Joomla / joomla\! | 2026-09-29 | 2026-10-06 |
| CVE-2026-102697 Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerab... |
high | 7.8 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102796 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.5 | — | — | 2026-09-29 | 2026-10-01 |
| CVE-2026-102634 SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate du... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102675 Electron is a framework for writing cross-platform desktop applications using Ja... |
high | 7.4 | — | Electronjs / electron | 2026-09-29 | 2026-10-27 |
| CVE-2026-102424 Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates loca... |
high | 7.5 | — | Balbooa / forms | 2026-09-29 | 2026-10-06 |
| CVE-2026-102556 A flaw was found in libsoup. |
high | 8.6 | — | Gnome / libsoup | 2026-09-29 | 2026-10-19 |
| CVE-2026-102557 A flaw was found in libsoup. |
high | 8.6 | — | Gnome / libsoup | 2026-09-29 | 2026-10-19 |
| CVE-2026-100241 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wiki... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-100242 Dependency on Vulnerable Third-Party Component and Uncontrolled Resource Consump... |
high | 7.5 | — | — | 2026-09-29 | 2026-10-01 |
| CVE-2026-100244 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wiki... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2022-51019 Akaunting before 2.1.31 contains an OS command injection vulnerability in the mo... |
high | 8.8 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-97687 urllib3 is an HTTP client library for Python. |
high | 8.1 | — | Python / urllib3 | 2026-09-29 | 2026-10-13 |
| CVE-2026-97689 urllib3 is an HTTP client library for Python. |
high | 7.5 | — | Python / urllib3 | 2026-09-29 | 2026-10-13 |
| CVE-2026-92370 An improper access control vulnerability in TeamViewer Full Client, Host, and re... |
high | 8.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-92371 TeamViewer Full Client and Host for Linux prior version 15.82 contains an improp... |
high | 7.0 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-92368 TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain... |
high | 7.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-92369 TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCT... |
high | 7.3 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-84782 Issue summary: The DTLS retransmission logic does not correctly handle
a handsha... |
high | 8.2 | — | Openssl / openssl | 2026-09-29 | 2026-10-08 |
| CVE-2026-84783 Issue summary: The first concurrent use of the same X.509 certificate by
several... |
high | 7.5 | — | Openssl / openssl | 2026-09-29 | 2026-10-08 |
| CVE-2026-84784 Issue summary: A malicious remote peer may flood the local QUIC
stack with NEW_C... |
high | 7.5 | — | Openssl / openssl | 2026-09-29 | 2026-10-08 |
| CVE-2026-72897 Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a
connection... |
high | 7.5 | — | Openssl / openssl | 2026-09-29 | 2026-10-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.