September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-94450 Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 a... |
high | 7.5 | — | — | 2026-09-22 | 2026-10-20 |
| CVE-2026-67615 openEQUELLA before 2026.1.0 contains an authenticated remote code execution vuln... |
high | 8.8 | — | — | 2026-09-22 | 2026-10-29 |
| CVE-2026-94574 A local cross-user code execution vulnerability exists in GNU wget (Windows buil... |
high | 7.8 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-88419 An unrestricted upload of files with a dangerous type in the thumbnail-upload en... |
high | 8.8 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-89281 The Apache Lounge Windows distribution of Apache HTTP Server build contains a ha... |
high | 8.4 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-88340 An invalid pointer release vulnerability exists in YARA 4.5.8 during deserializa... |
high | 7.6 | — | — | 2026-09-22 | 2026-09-25 |
| CVE-2026-88344 An out-of-bounds read vulnerability exists in the schema lexer of flatcc 4c3b999... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-88345 An out-of-bounds read vulnerability exists in the schema lexer of flatcc 4c3b999... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-88418 CMSimple 5.24 ships with CSRF protection disabled by default, which turns csrfPr... |
high | 8.8 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-77322 SIPGO is a library for writing SIP services in the GO language. |
high | 7.5 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-76712 A vulnerability exists in the Analytics and Location Engine (ALE) that may allow... |
high | 7.3 | — | Arubanetworks / analytics and location engine | 2026-09-22 | 2026-09-28 |
| CVE-2026-76713 A vulnerability exists in the maintenance restore functionality of Analytics and... |
high | 7.2 | — | Arubanetworks / analytics and location engine | 2026-09-22 | 2026-09-28 |
| CVE-2026-76714 Vulnerabilities in the Analytics and Location Engine web interface allows remote... |
high | 7.2 | — | Arubanetworks / analytics and location engine | 2026-09-22 | 2026-09-28 |
| CVE-2026-76715 A vulnerability in an administrative component of Analytics and Location Engine... |
high | 7.1 | — | Arubanetworks / analytics and location engine | 2026-09-22 | 2026-09-28 |
| CVE-2026-76710 A vulnerability exists in the Analytics and Location Engine (ALE) management int... |
high | 7.5 | — | Arubanetworks / analytics and location engine | 2026-09-22 | 2026-09-28 |
| CVE-2026-76711 A vulnerability exists in an Analytics and Location Engine (ALE) component where... |
high | 7.5 | — | Arubanetworks / analytics and location engine | 2026-09-22 | 2026-09-28 |
| CVE-2026-59991 psd-tools is a Python package for working with Adobe Photoshop PSD files. |
high | 7.5 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-61570 MPXJ is an open source library to read and write project plans from a variety of... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-62985 request-filtering-agent is an http(s).Agent implementation that blocks requests... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-63104 Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerabilit... |
high | 8.1 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-28325 SolarWinds Observability Self-Hosted was found to be affected by an unauthentica... |
high | 8.8 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-58268 SIPGO is a library for writing SIP services in the GO language. |
high | 7.5 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-95831 Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware... |
high | 7.8 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-95861 A malicious actor with access to the network could exploit an Uncontrolled Recur... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95862 A malicious actor with access to the network could exploit an Out-of-bounds Writ... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-94462 Spree is an open source e-commerce solution built with Ruby on Rails. |
high | 7.1 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-88415 MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting (XSS). |
high | 8.7 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-83963 Substance3D - Modeler is affected by an out-of-bounds write vulnerability that c... |
high | 7.8 | — | Adobe / substance 3d modeler | 2026-09-22 | 2026-09-25 |
| CVE-2026-83964 Adobe Connect is affected by an Improper Certificate Validation vulnerability th... |
high | 7.5 | — | Adobe / connect | 2026-09-22 | 2026-09-26 |
| CVE-2026-84395 Premiere Pro is affected by a Server-Side Request Forgery (SSRF) vulnerability t... |
high | 7.1 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-81998 Substance3D - Modeler is affected by an out-of-bounds write vulnerability that c... |
high | 7.8 | — | Adobe / substance 3d modeler | 2026-09-22 | 2026-09-25 |
| CVE-2026-81999 Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery... |
high | 8.7 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-83962 Substance3D - Modeler is affected by a Stack-based Buffer Overflow vulnerability... |
high | 7.8 | — | Adobe / substance 3d modeler | 2026-09-22 | 2026-09-25 |
| CVE-2026-79906 Substance3D - Modeler is affected by an out-of-bounds write vulnerability that c... |
high | 7.8 | — | Adobe / substance 3d modeler | 2026-09-22 | 2026-09-25 |
| CVE-2026-77544 A malicious actor with access to the network could exploit an Out-of-bounds Writ... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-77555 A malicious actor with access to the network could exploit an Out-of-bounds Writ... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-77556 A malicious actor with access to the network could exploit an Out-of-bounds Read... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-77558 A malicious actor with access to the network could exploit an Out-of-bounds Read... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-77259 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 7.7 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-77262 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 8.6 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.