September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92469 zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vu... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92362 A vulnerability was detected in ag-ui-protocol ag-ui 1.0. |
high | 7.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-92134 Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier does not validate... |
high | 8.0 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92135 Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the c... |
high | 8.0 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92136 Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE valu... |
high | 8.0 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92137 Jenkins Robot Framework Plugin 6.2.2 and earlier does not check that the archive... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92122 Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check... |
high | 8.8 | — | Jenkins / script security | 2026-09-16 | 2026-09-21 |
| CVE-2026-92123 Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not interc... |
high | 8.8 | — | Jenkins / script security | 2026-09-16 | 2026-09-21 |
| CVE-2026-92124 Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier checks the oper... |
high | 8.8 | — | Jenkins / script security | 2026-09-16 | 2026-09-21 |
| CVE-2026-92125 Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject... |
high | 8.8 | — | Jenkins / script security | 2026-09-16 | 2026-09-21 |
| CVE-2026-92126 Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject... |
high | 8.5 | — | Jenkins / script security | 2026-09-16 | 2026-09-27 |
| CVE-2026-92127 Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically a... |
high | 8.0 | — | Jenkins / script security | 2026-09-16 | 2026-09-21 |
| CVE-2026-92128 Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR... |
high | 7.5 | — | Jenkins / script security | 2026-09-16 | 2026-09-21 |
| CVE-2026-92129 Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check... |
high | 7.5 | — | Jenkins / script security | 2026-09-16 | 2026-09-21 |
| CVE-2026-89028 MikroTik RouterOS before 7.24 contains a heap memory corruption vulnerability in... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-81563 A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or mo... |
high | 7.5 | — | — | 2026-09-16 | 2026-10-26 |
| CVE-2026-81736 If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is the... |
high | 7.5 | — | — | 2026-09-16 | 2026-10-26 |
| CVE-2026-77692 An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS reque... |
high | 7.5 | — | — | 2026-09-16 | 2026-10-26 |
| CVE-2026-61590 djust provides Phoenix LiveView-style reactive server-side rendering for Django... |
high | 7.4 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-19667 If an attacker-controlled authoritative server can produce a negative answer tha... |
high | 7.5 | — | — | 2026-09-16 | 2026-10-26 |
| CVE-2026-92465 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92456 yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and g... |
high | 7.1 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-90041 In the Linux kernel, the following vulnerability has been resolved:
HID: sony:... |
high | 8.8 | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-90043 In the Linux kernel, the following vulnerability has been resolved:
zram: fix s... |
high | 7.8 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-90044 In the Linux kernel, the following vulnerability has been resolved:
usb: gadget... |
high | 7.8 | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-90045 In the Linux kernel, the following vulnerability has been resolved:
USB: gadget... |
high | 7.8 | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-90046 In the Linux kernel, the following vulnerability has been resolved:
mm/page_all... |
high | 7.8 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-90047 In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Don... |
high | 7.8 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-90030 In the Linux kernel, the following vulnerability has been resolved:
usb: dwc3:... |
high | 7.8 | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-90032 In the Linux kernel, the following vulnerability has been resolved:
media: usbt... |
high | 7.8 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-90022 In the Linux kernel, the following vulnerability has been resolved:
usb: gadget... |
high | 7.8 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-90025 In the Linux kernel, the following vulnerability has been resolved:
usb: typec:... |
high | 7.7 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-90026 In the Linux kernel, the following vulnerability has been resolved:
usb: typec:... |
high | 7.8 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-90027 In the Linux kernel, the following vulnerability has been resolved:
usb: typec:... |
high | 7.8 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-90014 In the Linux kernel, the following vulnerability has been resolved:
tracing: Ha... |
high | 7.8 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-90016 In the Linux kernel, the following vulnerability has been resolved:
staging: rt... |
high | 7.1 | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-90017 In the Linux kernel, the following vulnerability has been resolved:
staging: rt... |
high | 7.1 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-90018 In the Linux kernel, the following vulnerability has been resolved:
staging: rt... |
high | 8.8 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-90007 In the Linux kernel, the following vulnerability has been resolved:
scsi: pm800... |
high | 7.8 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-90008 In the Linux kernel, the following vulnerability has been resolved:
scsi: megar... |
high | 7.8 | — | — | 2026-09-16 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.