September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-89841 In the Linux kernel, the following vulnerability has been resolved:
f2fs: only... |
high | 7.8 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89825 In the Linux kernel, the following vulnerability has been resolved:
drm/panthor... |
high | 7.8 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89826 In the Linux kernel, the following vulnerability has been resolved:
drm/panthor... |
high | 7.1 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89829 In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix t... |
high | 7.8 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89832 In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix t... |
high | 7.8 | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-89823 In the Linux kernel, the following vulnerability has been resolved:
drm: fix ra... |
high | 7.8 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89818 In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/... |
high | 7.1 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89819 In the Linux kernel, the following vulnerability has been resolved:
drm/amd/dis... |
high | 7.8 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89810 In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd:... |
high | 7.8 | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-89811 In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd:... |
high | 8.8 | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-89814 In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu:... |
high | 7.8 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89815 In the Linux kernel, the following vulnerability has been resolved:
drm/ttm: Dr... |
high | 7.8 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89803 In the Linux kernel, the following vulnerability has been resolved:
drm/nouveau... |
high | 7.8 | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-89804 In the Linux kernel, the following vulnerability has been resolved:
drm/nouveau... |
high | 8.8 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89805 In the Linux kernel, the following vulnerability has been resolved:
drm/pagemap... |
high | 7.8 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89806 In the Linux kernel, the following vulnerability has been resolved:
drm/sysfb:... |
high | 8.4 | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-89808 In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd:... |
high | 7.8 | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-89795 In the Linux kernel, the following vulnerability has been resolved:
PCI: Allow... |
high | 8.4 | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-89799 In the Linux kernel, the following vulnerability has been resolved:
bpf: Disabl... |
high | 7.8 | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-89801 In the Linux kernel, the following vulnerability has been resolved:
drm/nouveau... |
high | 7.8 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-86792 Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted... |
high | 8.8 | — | Apache / apache-airflow-providers-apache-kafka | 2026-09-16 | 2026-09-18 |
| CVE-2026-89793 In the Linux kernel, the following vulnerability has been resolved:
ublk: clear... |
high | 7.8 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-86466 Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager do... |
high | 8.1 | — | Apache / apache-airflow-providers-fab | 2026-09-16 | 2026-09-18 |
| CVE-2026-79993 The `deleteContainer` opcode (0x14/20) is processed without verifying the caller... |
high | 7.5 | — | Apache / zookeeper | 2026-09-16 | 2026-09-18 |
| CVE-2026-82310 Apache Airflow FAB provider: deactivating a user account does not stop tokens is... |
high | 7.2 | — | Apache / apache-airflow-providers-fab | 2026-09-16 | 2026-09-18 |
| CVE-2026-73455 On affected platforms running Arista EOS with Open Shortest Path First version 3... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-59739 Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due t... |
high | 7.5 | — | Apache / zookeeper | 2026-09-16 | 2026-09-18 |
| CVE-2026-59969 Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-... |
high | 7.5 | — | Apache / zookeeper | 2026-09-16 | 2026-09-18 |
| CVE-2026-73435 On affected platforms running Arista EOS with Open Shortest Path First version 2... |
high | 8.2 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-89792 In the Linux kernel, the following vulnerability has been resolved:
ksmbd: prev... |
high | 7.1 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89789 In the Linux kernel, the following vulnerability has been resolved:
gtp: add sy... |
high | 7.8 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89791 In the Linux kernel, the following vulnerability has been resolved:
perf: Fix u... |
high | 7.8 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89777 In the Linux kernel, the following vulnerability has been resolved:
vfio/pci: c... |
high | 8.8 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89781 In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: f... |
high | 8.4 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89782 In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: r... |
high | 8.4 | — | — | 2026-09-16 | 2026-10-19 |
| CVE-2026-89774 In the Linux kernel, the following vulnerability has been resolved:
Bluetooth:... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-80225 In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulner... |
high | 7.5 | — | Nlnetlabs / unbound | 2026-09-16 | 2026-09-23 |
| CVE-2026-81634 In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a... |
high | 7.5 | — | Nlnetlabs / unbound | 2026-09-16 | 2026-09-23 |
| CVE-2026-85501 Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have be... |
high | 7.5 | — | Nlnetlabs / unbound | 2026-09-16 | 2026-09-23 |
| CVE-2026-73454 On affected platforms running Arista EOS with gRPC Network Security Interface (g... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.