September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,152
Critical
1,210
High
4,303
Medium
4,042
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-97426 In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/... |
not reported | — | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-97431 In the Linux kernel, the following vulnerability has been resolved:
drm/amd/dis... |
not reported | — | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-97423 In the Linux kernel, the following vulnerability has been resolved:
cxl/region:... |
not reported | — | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-97410 In the Linux kernel, the following vulnerability has been resolved:
netconsole:... |
not reported | — | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-97414 In the Linux kernel, the following vulnerability has been resolved:
ASoC: media... |
not reported | — | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-93818 In the Linux kernel, the following vulnerability has been resolved:
PCI: plda:... |
not reported | — | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-93809 In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu:... |
not reported | — | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-86857 ServiceNow has remediated an authorization bypass security issue that was identi... |
not reported | — | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-50227 An unauthenticated local attacker can connect to the MQTT broker over its localh... |
not reported | — | — | — | 2026-09-23 | 2026-09-25 |
| CVE-2026-50228 An unauthenticated local attacker can connect to the Electron DevTools endpoint... |
not reported | — | — | — | 2026-09-23 | 2026-09-25 |
| CVE-2026-97622 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-86860 ServiceNow has remediated a missing authorization vulnerability that was identif... |
not reported | — | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-94572 In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate... |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-76898 draw.io is a configurable diagramming and whiteboarding application. |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-61852 Chartbrew is an open-source web application that can connect directly to databas... |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-52741 GoCD is a continuous deliver server. |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-54571 ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32... |
not reported | — | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-55061 uniget is a universal installer and updater for (container) tools. |
not reported | — | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54237 Wavelog is web-based amateur radio logging software. |
not reported | — | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54501 Browsertrix is a high-fidelity, browser-based crawling service for web archiving... |
not reported | — | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-62943 btrbk is a tool for creating snapshots and remote backups of Btrfs subvolumes. |
not reported | — | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-77339 Process Compose is a scheduler and orchestrator for non-containerized applicatio... |
not reported | — | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-81505 Convoy is a cloud native webhooks gateway. |
not reported | — | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-63445 Perses is an open-source dashboard and visualization project for observability d... |
not reported | — | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-64847 AnyIO is a high level asynchronous concurrency and networking framework that wor... |
not reported | — | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-55074 Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeB... |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-91167 Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-61647 NotebookLM MCP is an MCP server and HTTP service for interacting with Google Not... |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-61652 Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of... |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-61851 Chartbrew is an open-source web application that can connect directly to databas... |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-75510 Novu provides an API for sending notifications through multiple channels. |
not reported | — | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-77619 Vector is a high-performance observability data pipeline. |
not reported | — | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-77620 Vector is a high-performance observability data pipeline. |
not reported | — | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-55556 Rsyslog is a rocket-fast system for log processing. |
not reported | — | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-83803 Sentry is an error tracking and performance monitoring tool. |
not reported | — | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-52836 OpenDDS is an open source C++ implementation of the Object Management Group (OMG... |
not reported | — | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-73863 NanoMQ is an MQTT broker. |
not reported | — | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-53534 JabRef is a desktop application for managing BibTeX and BibLaTeX libraries. |
not reported | — | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-52740 GoCD is a continuous deliver server. |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-52742 GoCD is a continuous deliver server. |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.