September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-95842 Moquette is a lightweight Java MQTT broker. |
high | 7.5 | — | Moquette / moquette | 2026-09-23 | 2026-09-25 |
| CVE-2026-93349 Frictionless before 5.19.1 contains an OS command injection vulnerability in the... |
high | 8.8 | — | — | 2026-09-23 | 2026-09-28 |
| CVE-2026-88830 A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-88832 BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled met... |
high | 7.3 | — | — | 2026-09-23 | 2026-09-25 |
| CVE-2026-6668 Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 a... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-19888 Missing validation of a mandatory attribute in the SCRAM client-final-message pa... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-96673 Photoview through 2.4.0 contains an SQL injection vulnerability in the album dow... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-79310 webpy web.py 0.76 is vulnerable to server-side template injection (SSTI). |
high | 8.5 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-19179 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
high | 8.2 | — | Ibm / financial transaction manager | 2026-09-23 | 2026-10-07 |
| CVE-2026-18181 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
high | 8.1 | — | Ibm / financial transaction manager | 2026-09-23 | 2026-10-07 |
| CVE-2026-18184 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
high | 7.4 | — | Ibm / financial transaction manager | 2026-09-23 | 2026-10-07 |
| CVE-2026-18185 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
high | 7.3 | — | Ibm / financial transaction manager | 2026-09-23 | 2026-10-07 |
| CVE-2026-18490 IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to un... |
high | 8.8 | — | Ibm / financial transaction manager | 2026-09-23 | 2026-10-07 |
| CVE-2026-18875 IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to RA... |
high | 7.3 | — | Ibm / financial transaction manager | 2026-09-23 | 2026-10-07 |
| CVE-2026-96611 FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. |
high | 7.8 | — | Ffmpeg / ffmpeg | 2026-09-23 | 2026-10-15 |
| CVE-2026-96275 A malicious or compromised Flatpak repository can write attacker-controlled cont... |
high | 8.8 | — | — | 2026-09-23 | 2026-10-29 |
| CVE-2026-73591 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 7.5 | — | Dell / policy manager for secure connect gateway | 2026-09-23 | 2026-09-25 |
| CVE-2026-73588 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 7.4 | — | Dell / policy manager for secure connect gateway | 2026-09-23 | 2026-09-25 |
| CVE-2026-55610 InvoiceShelf is an open-source web & mobile app that helps track expenses, payme... |
high | 8.7 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-96512 A flaw was found in sudo. |
high | 7.8 | — | — | 2026-09-23 | 2026-10-29 |
| CVE-2026-86679 ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulner... |
high | 7.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-86681 ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulner... |
high | 7.6 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-86683 ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a l... |
high | 8.1 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-86677 ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a l... |
high | 8.8 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-86678 ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a l... |
high | 8.8 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-18177 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
high | 7.1 | — | Ibm / financial transaction manager | 2026-09-23 | 2026-10-07 |
| CVE-2026-95676 A missing/improper authentication vulnerability in the WatchGuard AuthPoint Gate... |
high | 7.5 | — | Watchguard / authentication gateway | 2026-09-23 | 2026-10-07 |
| CVE-2026-86247 Race condition within a thread vulnerability in Apache Tomcat Native allowed cli... |
high | 7.4 | — | Apache / tomcat native | 2026-09-23 | 2026-10-06 |
| CVE-2026-86243 Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake... |
high | 7.5 | — | Apache / tomcat native | 2026-09-23 | 2026-10-06 |
| CVE-2026-76978 ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and belo... |
high | 8.8 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-76979 ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and belo... |
high | 7.7 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-76980 ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and belo... |
high | 7.4 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-75825 ZohoCorp ManageEngine OpManager versions 12.8.710 and below with the Application... |
high | 8.8 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-84791 ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and belo... |
high | 7.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-87022 Improper handling of length parameter inconsistency vulnerability in Apache Tomc... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-78383 Allocation of resources without limits or throttling vulnerability in Apache Tom... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-78437 Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to... |
high | 7.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-79677 Missing release of resource after effective lifetime, Comparison using wrong fac... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-84787 ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and belo... |
high | 8.1 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-84789 ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and belo... |
high | 7.1 | — | — | 2026-09-23 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.