September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-54873 Issue summary: QUIC process may keep memory for QUIC packet
buffer for much long... |
high | 7.5 | — | Openssl / openssl | 2026-09-29 | 2026-10-08 |
| CVE-2026-19743 Improper path validation in the local IPC service of TeamViewer Full Client and... |
high | 7.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102600 Socket.IO enables bidirectional and low-latency communication for every platform... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-100288 Cleartext storage of sensitive information in the database in Devolutions Server... |
high | 7.2 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-100308 Deserialization of untrusted data in the model loading component in Amazon Gluon... |
high | 7.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-86035 Weblate is a web-based continuous localization platform used to manage software... |
high | 8.5 | — | — | 2026-09-29 | 2026-10-02 |
| CVE-2026-63209 compress provides various compression algorithms. |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-65102 NVIDIA DeepStream contains a vulnerability where an attacker could cause an inte... |
high | 7.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102566 CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary mod... |
high | 7.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102491 A vulnerability was identified in mahonelau kykms up to 8f130c2d85842d5b44caae78... |
high | 7.3 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2015-20122 Seeyon A6 collaborative office automation platform contains an unauthenticated S... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-97395 Apache Polaris allows an authenticated principal with permission to create or up... |
high | 8.1 | — | — | 2026-09-29 | 2026-10-01 |
| CVE-2026-86450 Insertion of sensitive information into sent data vulnerability in Parla Auto Au... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102360 A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and... |
high | 8.6 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102521 The decoder in `readFromDataView` in lib0 before 0.2.119 can be tricked into rea... |
high | 8.6 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-82804 The scriptPath parameter is incorporated into a /bin/sh -c command without suffi... |
high | 8.8 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-73598 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 7.8 | — | Dell / policy manager for secure connect gateway | 2026-09-29 | 2026-10-06 |
| CVE-2026-102437 OS Command Injection in internal/gitcmd (git diff filter.clean/smudge invocation... |
high | 7.8 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-100830 Mitigation bypass in the DOM: Navigation component. |
high | 8.1 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100831 Use-after-free in the DOM: UI Events & Focus Handling component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100832 Use-after-free in the Graphics: Canvas2D component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100820 Privilege escalation in the Address Bar component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100824 Privilege escalation in the Places component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100825 Use-after-free in the JavaScript Engine: JIT component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100809 Same-origin policy bypass in the DevTools component. |
high | 8.1 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100813 Invalid pointer in the JavaScript Engine: JIT component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100814 Incorrect boundary conditions in the JavaScript Engine: JIT component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100815 Use-after-free in the CSS Parsing and Computation component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100816 Site isolation issue in the DOM: Networking component. |
high | 8.1 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100801 Privilege escalation in the DLL Services component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-27 |
| CVE-2026-100803 Same-origin policy bypass in the WebExtensions component. |
high | 8.1 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100805 Race condition, use-after-free in the Audio/Video component. |
high | 7.5 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100807 Privilege escalation in the DOM: Service Workers component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100808 Mitigation bypass in the DOM: Service Workers component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100790 Use-after-free in the XSLT component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100791 Use-after-free in the DOM: Core & HTML component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100792 JIT miscompilation in the JavaScript: WebAssembly component. |
high | 7.1 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100796 Use-after-free in the JavaScript: WebAssembly component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100797 Privilege escalation due to use-after-free in the Graphics: WebRender component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100798 Cryptography misuse in Storage: Quota Manager component. |
high | 8.1 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.