September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,141
Critical
1,210
High
4,303
Medium
4,031
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-88857 Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Executio... |
not reported | — | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-86698 Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm h... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-77875 The application protects access through its calculator-style vault passcode, but... |
not reported | — | — | — | 2026-09-19 | 2026-09-22 |
| CVE-2026-90882 The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-82672 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')... |
not reported | — | — | — | 2026-09-19 | 2026-09-22 |
| CVE-2026-89422 Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allow... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-63272 LibreOffice can import WMF graphics, which may be embedded in documents. |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-63273 LibreOffice Draw can import PDF documents. |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-63274 LibreOffice Draw can import PDF documents. |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-63275 LibreOffice can read CFF fonts, which may be embedded in documents. |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-63276 LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens w... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-63278 URLs could be constructed which expanded environment variable or INI file values... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-63279 LibreOffice can import PICT images, which may be embedded in documents. |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-87119 Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holdin... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-89420 Improper Validation of Specified Quantity in Input in ZenHive mpp allows a clien... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-76819 Rejected reason: Further research determined the issue results from a dependency... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95754 In MISP's UsersController login() method, the pre-authentication database query... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95805 A typo in the MISP ACLComponent access control configuration caused the ACL rule... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95806 MISP ships with PHP's phar stream wrapper registered in both its web entry point... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95685 MISP contains an access control flaw in the EventReports functionality. |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95693 In MISP, the EventReport::uploadPicture method in processed a caller-supplied tm... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95697 MISP contains an authorization flaw in the Organisation model's captureOrg metho... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95698 The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by c... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95701 In MISP, the __statisticsOrgs method in UsersController.php used the organizatio... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95703 In MISP, the OrganisationsController::__uploadLogo method processed a caller-sup... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95671 In MISP, the CollectionsController add() method enforced the sharing-group usabi... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95674 In MISP, the queryEnrichment method in EventsController.php accepted a module na... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95679 MISP's RequestHandlerComponent automatically decodes XML request bodies on all w... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95682 MISP contains a stored cross-site scripting (XSS) vulnerability in the admin ema... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95683 In MISP, the Overmind event view enriches an event with its most recent attached... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95665 MISP contains a reflected cross-site scripting (XSS) vulnerability in the event... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95667 The MISP installer scripts (for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95658 MISP's WorkflowsController exposed the moduleStatelessExecution action in the Se... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95659 MISP contains a reflected cross-site scripting (XSS) vulnerability in the Analys... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95661 MISP contains a reflected cross-site scripting (XSS) vulnerability in the attrib... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95511 Rejected reason: Not a vulnerability. |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-93598 ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 contains a... |
not reported | — | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-90990 Improper neutralization of newlines in filter values in the monitoring host and... |
not reported | — | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-49995 Tautulli is a Python based monitoring and tracking tool for Plex Media Server. |
not reported | — | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-69664 Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP... |
not reported | — | — | — | 2026-09-01 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.