September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-90089 In the Linux kernel, the following vulnerability has been resolved:
Bluetooth:... |
high | 7.1 | — | — | 2026-09-17 | 2026-10-19 |
| CVE-2026-90091 In the Linux kernel, the following vulnerability has been resolved:
Bluetooth:... |
high | 8.0 | — | — | 2026-09-17 | 2026-10-19 |
| CVE-2026-90092 In the Linux kernel, the following vulnerability has been resolved:
Bluetooth:... |
high | 8.0 | — | — | 2026-09-17 | 2026-10-19 |
| CVE-2026-90093 In the Linux kernel, the following vulnerability has been resolved:
Bluetooth:... |
high | 7.8 | — | — | 2026-09-17 | 2026-10-21 |
| CVE-2026-90071 In the Linux kernel, the following vulnerability has been resolved:
net/sched:... |
high | 7.8 | — | — | 2026-09-17 | 2026-10-19 |
| CVE-2026-90067 In the Linux kernel, the following vulnerability has been resolved:
libceph: va... |
high | 7.5 | — | — | 2026-09-17 | 2026-10-19 |
| CVE-2026-90069 In the Linux kernel, the following vulnerability has been resolved:
crypto: aco... |
high | 7.8 | — | — | 2026-09-17 | 2026-10-19 |
| CVE-2026-90057 In the Linux kernel, the following vulnerability has been resolved:
slip: remov... |
high | 7.8 | — | — | 2026-09-17 | 2026-10-19 |
| CVE-2026-90059 In the Linux kernel, the following vulnerability has been resolved:
net: stmmac... |
high | 7.5 | — | — | 2026-09-17 | 2026-10-19 |
| CVE-2026-90062 In the Linux kernel, the following vulnerability has been resolved:
netfilter:... |
high | 7.1 | — | — | 2026-09-17 | 2026-10-19 |
| CVE-2026-90051 In the Linux kernel, the following vulnerability has been resolved:
tcp: reject... |
high | 7.8 | — | — | 2026-09-17 | 2026-10-19 |
| CVE-2026-28326 SolarWinds Access Rights Manager was reported to be affected by an unauthenticat... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-93014 RosarioSIS versions before 12.9 fail to validate the filename request parameter... |
high | 7.1 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-89036 Appwrite before 2.0.0 contains an argument injection vulnerability that allows a... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-86864 pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /... |
high | 8.8 | — | Pgadmin / pgadmin 4 | 2026-09-17 | 2026-09-21 |
| CVE-2026-86039 libp2p is a JavaScript implementation of the libp2p networking stack. |
high | 8.2 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-86040 libp2p is a JavaScript implementation of the libp2p networking stack. |
high | 7.5 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-85719 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-85721 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-86038 libp2p is a JavaScript implementation of the libp2p networking stack. |
high | 7.5 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-85715 ExifReader is a JavaScript Exif information parser. |
high | 7.5 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-81515 Steeltoe is an open source project that provides a collection of libraries that... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-81516 Steeltoe is an open source project that provides a collection of libraries that... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-76834 b2evolution CMS versions 6.7.8 through 7.2.5 contain an incomplete fix for CVE-2... |
high | 8.1 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-56795 Dell Server Update Utility, versions prior to 26.07.01, contains an Uncontrolled... |
high | 8.2 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-92986 SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree wi... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92987 roxmltree through 0.21.1 performs quadratic-time attribute and namespace validat... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92983 InternLM LMDeploy through 0.17.0 in DistServe prefill/decode disaggregation mode... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92984 HUBzero CMS through 2.2.32 accepts session identifiers from query strings and re... |
high | 8.1 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92985 SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebo... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-87742 A flaw was found in quarkus-websockets-next. |
high | 7.5 | — | — | 2026-09-17 | 2026-10-09 |
| CVE-2026-85077 Sanic is an opensource python web server/framework. |
high | 8.2 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-81445 Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Im... |
high | 7.2 | — | Dell / openmanage server administrator | 2026-09-17 | 2026-10-06 |
| CVE-2026-81446 Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Ser... |
high | 7.4 | — | Dell / openmanage server administrator | 2026-09-17 | 2026-10-06 |
| CVE-2026-77614 Opencast is a free, open-source platform to support the management of educationa... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-80356 Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Ex... |
high | 7.3 | — | Dell / openmanage server administrator | 2026-09-17 | 2026-10-06 |
| CVE-2026-63459 Vendure is an open-source headless commerce platform. |
high | 8.7 | — | — | 2026-09-17 | 2026-09-21 |
| CVE-2026-63460 Vendure is an open-source headless commerce platform. |
high | 7.5 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-26950 Dell SmartFabric Manager, versions prior to 2.2.1, contains an Insufficient Veri... |
high | 8.8 | — | Dell / smartfabric manager | 2026-09-17 | 2026-10-08 |
| CVE-2026-92971 InternLM LMDeploy through 0.17.0 contains a reachable assertion vulnerability in... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.