September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-91928 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Apache / sling xss protection api | 2026-09-23 | 2026-09-30 |
| CVE-2026-91999 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Apache / sling xss protection api | 2026-09-23 | 2026-09-30 |
| CVE-2026-92001 Improper restriction of recursive entity references in DTDs ('XML entity expansi... |
medium | 6.1 | — | Apache / sling xss protection api | 2026-09-23 | 2026-09-30 |
| CVE-2026-91867 When Neethi fetches a remote policy reference, it only limits the time per read,... |
medium | 4.3 | — | Apache / neethi | 2026-09-21 | 2026-09-25 |
| CVE-2026-82561 Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entir... |
medium | 6.5 | — | Apache / nifi | 2026-09-16 | 2026-09-21 |
| CVE-2026-81866 Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and veri... |
medium | 4.3 | — | Apache / nifi | 2026-09-16 | 2026-09-21 |
| CVE-2026-75880 An authenticated client could attach a consumer with a selector containing craft... |
medium | 6.5 | — | Apache / artemis | 2026-09-10 | 2026-09-18 |
| CVE-2026-84439 When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated... |
medium | 5.3 | — | Apache / zookeeper | 2026-09-16 | 2026-09-18 |
| CVE-2026-84501 An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooK... |
medium | 5.3 | — | Apache / zookeeper | 2026-09-16 | 2026-09-18 |
| CVE-2026-86465 Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guar... |
medium | 6.5 | — | Apache / apache-airflow-providers-akeyless | 2026-09-16 | 2026-09-17 |
| CVE-2026-57822 When the broker is processing message-based management requests, sent by an auth... |
medium | 6.5 | — | Apache / artemis | 2026-09-10 | 2026-09-16 |
| CVE-2026-54048 Specifying tblproperties('avro.schema.url'=' http://...' ) or with a 'file:///'... |
medium | 5.3 | — | Apache / impala | 2026-09-09 | 2026-09-10 |
| CVE-2026-32773 There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which... |
medium | 6.1 | — | Apache / spark | 2026-09-02 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.