September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-93559 A vulnerability was identified in Forget-C Jellyfish AI Short Drama Studio 0.1.0... |
high | 7.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-91149 A flaw was found in Cockpit. |
high | 7.5 | — | — | 2026-09-18 | 2026-09-30 |
| CVE-2026-77239 WACRM is a self-hostable CRM template for WhatsApp. |
high | 8.1 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-77301 adm-zip is a JavaScript library for creating and extracting ZIP archives in Node... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-61833 zot is a container image and artifact registry based on the Open Container Initi... |
high | 8.1 | — | — | 2026-09-18 | 2026-09-30 |
| CVE-2026-61548 Rsyslog is a rocket-fast system for log processing. |
high | 8.1 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-61672 Capsule is a multi-tenancy and policy-based framework for Kubernetes. |
high | 7.1 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-46655 virtio-win provides Windows paravirtualized drivers for QEMU and KVM. |
high | 7.8 | — | — | 2026-09-18 | 2026-09-30 |
| CVE-2026-58197 ToolHive is a utility designed to simplify the deployment and management of Mode... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-93690 uri-js through 4.4.1 contains a denial of service vulnerability in the removeDot... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93687 braces through 3.0.3 contains a stack overflow vulnerability in the recursive AS... |
high | 7.5 | — | — | 2026-09-18 | 2026-10-14 |
| CVE-2026-93688 SGLang through 0.5.19 in prefill/decode disaggregation mode with Mooncake KV tra... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-88259 CareCam CM2507 IP cameras do not require authentication for access to its networ... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-86520 Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read ac... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-84398 CM2507 IP cameras accept an empty password for a privileged account exposed thro... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-84444 libheif is a HEIF and AVIF file format decoder and encoder. |
high | 7.4 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-84446 libheif is a HEIF and AVIF file format decoder and encoder. |
high | 7.5 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-84447 libheif is a HEIF and AVIF file format decoder and encoder. |
high | 7.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-81944 PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions bef... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-84384 libheif is a HEIF and AVIF file format decoder and encoder. |
high | 7.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-81942 PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions bef... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-7006 Sublime Text for Windows through Build 4192 (Sublime Text 4) and Build 3207 (Sub... |
high | 7.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-63638 OpenImageIO is a toolset for reading, writing, and manipulating image files of a... |
high | 8.3 | — | Openimageio / openimageio | 2026-09-18 | 2026-09-29 |
| CVE-2026-67549 OpenImageIO is a toolset for reading, writing, and manipulating image files of a... |
high | 7.6 | — | Openimageio / openimageio | 2026-09-18 | 2026-09-29 |
| CVE-2026-63419 OpenImageIO is a toolset for reading, writing, and manipulating image files of a... |
high | 7.8 | — | Openimageio / openimageio | 2026-09-18 | 2026-09-29 |
| CVE-2026-63422 OpenImageIO is a toolset for reading, writing, and manipulating image files of a... |
high | 7.8 | — | Openimageio / openimageio | 2026-09-18 | 2026-09-29 |
| CVE-2026-54148 http4k is a functional toolkit for Kotlin HTTP applications. |
high | 8.1 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-10853 IBM MQ could allow an authenticated attacker with cluster access to cause a deni... |
high | 8.8 | — | Ibm / mq | 2026-09-18 | 2026-09-23 |
| CVE-2026-11375 IBM MQ could allow an authenticated attacker to cause a denial of service or pot... |
high | 8.8 | — | Ibm / mq | 2026-09-18 | 2026-09-23 |
| CVE-2026-11378 IBM MQ could allow an authenticated attacker to cause a denial of service or pot... |
high | 8.8 | — | Ibm / mq | 2026-09-18 | 2026-09-23 |
| CVE-2026-11381 IBM MQ could allow an authenticated attacker to cause a denial of service or pot... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-10030 IBM MQ Console allows authenticated non-administrative users to create and start... |
high | 7.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-10575 IBM MQ could allow an authenticated attacker to cause a denial of service or pot... |
high | 8.8 | — | Ibm / mq | 2026-09-18 | 2026-09-23 |
| CVE-2026-10744 IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attac... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-10751 IBM MQ Java and JMS client libraries could allow an authenticated attacker to ex... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2025-61682 Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users... |
high | 8.6 | — | — | 2026-09-18 | 2026-10-14 |
| CVE-2025-14753 IBM Cloud Pak for Data 5.1.2 could allow a remote attacker to traverse directori... |
high | 7.5 | — | Ibm / cloud pak for data | 2026-09-18 | 2026-10-14 |
| CVE-2025-14754 IBM Cloud Pak for Data 5.1.2 could allow an authenticated user to execute arbitr... |
high | 8.8 | — | Ibm / cloud pak for data | 2026-09-18 | 2026-10-14 |
| CVE-2026-93657 hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof sta... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93658 uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install d... |
high | 7.0 | — | — | 2026-09-18 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.