September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-49453 Joplin is an open source note-taking and to-do application that organises notes... |
high | 7.0 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-81469 Dell Inventory Collector Client, versions prior to 15.0.0, contain an Unquoted S... |
high | 7.8 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-73546 Envoy is an open source edge and service proxy designed for cloud-native applica... |
high | 7.4 | — | Envoyproxy / envoy | 2026-09-21 | 2026-10-05 |
| CVE-2026-73547 Envoy is an open source edge and service proxy designed for cloud-native applica... |
high | 7.5 | — | Envoyproxy / envoy | 2026-09-21 | 2026-10-06 |
| CVE-2026-73548 Envoy is an open source edge and service proxy designed for cloud-native applica... |
high | 7.5 | — | Envoyproxy / envoy | 2026-09-21 | 2026-10-05 |
| CVE-2026-73550 Envoy is an open source edge and service proxy designed for cloud-native applica... |
high | 7.5 | — | Envoyproxy / envoy | 2026-09-21 | 2026-10-05 |
| CVE-2026-73552 Envoy is an open source edge and service proxy designed for cloud-native applica... |
high | 7.5 | — | Envoyproxy / envoy | 2026-09-21 | 2026-10-05 |
| CVE-2026-73512 Envoy is an open source edge and service proxy designed for cloud-native applica... |
high | 7.5 | — | Envoyproxy / envoy | 2026-09-21 | 2026-10-05 |
| CVE-2026-73513 Envoy is an open source edge and service proxy designed for cloud-native applica... |
high | 7.5 | — | Envoyproxy / envoy | 2026-09-21 | 2026-10-05 |
| CVE-2026-55159 luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for Ope... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-29 |
| CVE-2026-55897 luci-app-advanced-reboot is a LuCI (web interface) application for OpenWrt that... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-58269 Sync-in Server is an open-source platform for file storage, sharing, collaborati... |
high | 8.1 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-49811 Dell Command | Monitor (DCM), versions prior to 10.13.2, contain an Incorrect Pe... |
high | 8.4 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94495 jshERP through 3.6 fails to properly validate user privileges in SystemConfigSer... |
high | 7.1 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-94496 jshERP through 3.6 fails to validate caller permissions in role management endpo... |
high | 8.3 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94497 jshERP through 3.6 fails to validate object ownership in by-id info, update, and... |
high | 8.3 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94501 jshERP through 3.6 contains an authorization bypass vulnerability in the userBus... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94411 jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueBy... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-94412 jshERP through 3.6 contains an authorization bypass vulnerability in the POST /u... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94403 A weakness has been identified in ColorFul iGameCenter 1.0.3.4. |
high | 8.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-63330 Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. |
high | 7.7 | — | — | 2026-09-21 | 2026-09-30 |
| CVE-2026-49810 Dell Command Powershell Provider (DCPP), versions prior to 2.10.2 contain an Ins... |
high | 7.8 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-17052 The Time-aware GPIO syscall verification handler z_vrfy_tgpio_pin_read_ts_ec() i... |
high | 7.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94488 Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. |
high | 8.2 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-62182 KubeEdge is an open source system for extending native containerized application... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-62369 KubeEdge is an open source system for extending native containerized application... |
high | 8.1 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-48826 HomeBox is a home inventory and organization system. |
high | 8.1 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-48975 HomeBox is a home inventory and organization system. |
high | 8.1 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-48976 HomeBox is a home inventory and organization system. |
high | 8.1 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-94449 A flaw was found in the SmallRye Fault Tolerance library, which is used by Quark... |
high | 7.5 | — | — | 2026-09-21 | 2026-10-16 |
| CVE-2026-84990 ntopng is a web-based network traffic monitoring application. |
high | 8.8 | — | — | 2026-09-21 | 2026-09-29 |
| CVE-2026-83621 ntopng is a web-based network traffic monitoring application. |
high | 8.1 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-77560 Tinyauth is an authentication and authorization server. |
high | 8.1 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-63116 deepstream is a server that allows clients and backend services to sync data, se... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-62371 KubeEdge is an open source system for extending native containerized application... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-82412 ntopng is a web-based network traffic monitoring application. |
high | 8.8 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-53940 Conda is a system-level binary package and environment manager that runs on majo... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-61687 Hatchet is a platform for orchestrating background tasks, AI agents, and durable... |
high | 7.1 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-36467 Unrestricted Upload of File with Dangerous Type in core/modules/media.php in Cut... |
high | 7.2 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-80110 A flaw was found in pki-core. |
high | 8.1 | — | — | 2026-09-21 | 2026-10-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.