September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-88373 libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the... |
high | 7.5 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-88376 Bento4 1.6.0.0 contains an integer underflow vulnerability in AP4_AvccAtom::Crea... |
high | 7.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-88382 hiredis commit 29ea279 (post-v1.5.0) contains an uncontrolled memory allocation... |
high | 7.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-79764 Termix is a web-based server management platform with SSH terminal, tunneling, a... |
high | 7.7 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-62368 Snipe-IT is an IT asset/license management system. |
high | 8.4 | — | Snipeitapp / snipe-it | 2026-09-24 | 2026-09-29 |
| CVE-2026-63493 Snipe-IT is an IT asset/license management system. |
high | 8.1 | — | Snipeitapp / snipe-it | 2026-09-24 | 2026-09-29 |
| CVE-2026-96744 Improper neutralization of special elements in data query logic in the cache loc... |
high | 7.1 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96750 MongoDB Compass can interpolate a database name without escaping into the initia... |
high | 7.1 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-93280 In the Linux kernel, the following vulnerability has been resolved:
greybus: au... |
high | 8.8 | — | — | 2026-09-24 | 2026-10-19 |
| CVE-2026-93282 In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix... |
high | 8.1 | — | — | 2026-09-24 | 2026-10-21 |
| CVE-2026-93277 In the Linux kernel, the following vulnerability has been resolved:
RDMA/bnxt_r... |
high | 7.8 | — | — | 2026-09-24 | 2026-10-19 |
| CVE-2026-93265 In the Linux kernel, the following vulnerability has been resolved:
PCI/pwrctrl... |
high | 7.7 | — | — | 2026-09-24 | 2026-10-19 |
| CVE-2026-93260 In the Linux kernel, the following vulnerability has been resolved:
powerpc/xiv... |
high | 7.4 | — | — | 2026-09-24 | 2026-10-21 |
| CVE-2026-93262 In the Linux kernel, the following vulnerability has been resolved:
md/raid5-pp... |
high | 7.8 | — | — | 2026-09-24 | 2026-10-19 |
| CVE-2026-93250 In the Linux kernel, the following vulnerability has been resolved:
vxlan: mdb:... |
high | 7.8 | — | — | 2026-09-24 | 2026-10-19 |
| CVE-2026-93237 In the Linux kernel, the following vulnerability has been resolved:
LoongArch:... |
high | 7.8 | — | — | 2026-09-24 | 2026-10-19 |
| CVE-2026-93229 In the Linux kernel, the following vulnerability has been resolved:
nfsd: add m... |
high | 7.1 | — | — | 2026-09-24 | 2026-10-19 |
| CVE-2026-93221 In the Linux kernel, the following vulnerability has been resolved:
nfsd: conve... |
high | 8.1 | — | — | 2026-09-24 | 2026-10-21 |
| CVE-2026-93224 In the Linux kernel, the following vulnerability has been resolved:
svcrdma: Fi... |
high | 8.1 | — | — | 2026-09-24 | 2026-10-19 |
| CVE-2026-93225 In the Linux kernel, the following vulnerability has been resolved:
phy: fsl-im... |
high | 7.4 | — | — | 2026-09-24 | 2026-10-19 |
| CVE-2026-88361 SumatraPDF 3.6.1 contains an integer overflow vulnerability in EngineMupdf::Buil... |
high | 7.5 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-88362 MuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsR_isi... |
high | 7.5 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-88366 NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability... |
high | 7.5 | — | — | 2026-09-24 | 2026-10-06 |
| CVE-2026-88368 NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability... |
high | 7.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-88369 zserge jsmn commit 25647e6 is vulnerable to Buffer Overflow in example/jsondump.... |
high | 7.3 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-88355 An incorrect buffer size calculation vulnerability exists in tinyexpr commit 4a7... |
high | 7.5 | — | — | 2026-09-24 | 2026-10-06 |
| CVE-2026-88357 nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer de... |
high | 7.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-75907 The door access control on a Norwegian Cruise Line asset grants entry based only... |
high | 7.5 | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-77581 BentoPDF is a client-side PDF toolkit that is self hostable. |
high | 8.6 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-67233 RabbitMQ is a messaging and streaming broker. |
high | 7.1 | — | Broadcom / rabbitmq server | 2026-09-24 | 2026-10-19 |
| CVE-2026-63203 Logto is the modern, open-source auth infrastructure for SaaS and AI apps. |
high | 7.6 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-56737 phpMyFAQ is an open source FAQ web application. |
high | 8.1 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-97362 HFS2 version 2.4.0 and earlier contains a denial of service vulnerability that a... |
high | 7.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-90959 A path traversal vulnerability was found in pulpcore. |
high | 8.1 | — | — | 2026-09-24 | 2026-10-21 |
| CVE-2026-81552 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-24 | 2026-10-06 |
| CVE-2026-82093 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-24 | 2026-10-06 |
| CVE-2026-82094 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 7.1 | — | Ibm / datastage on cloud pak for data | 2026-09-24 | 2026-10-06 |
| CVE-2026-81539 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-24 | 2026-10-06 |
| CVE-2026-81545 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-24 | 2026-10-06 |
| CVE-2026-81547 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-24 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.