September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,141
Critical
1,210
High
4,303
Medium
4,031
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-93296 MISP contains a stored cross-site scripting (XSS) vulnerability in the Overmind... |
not reported | — | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-93295 MISP contains a vulnerability in its background job dispatch mechanism that allo... |
not reported | — | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-54575 mport is the MidnightBSD Package Manager. |
not reported | — | — | — | 2026-09-17 | 2026-09-21 |
| CVE-2026-54586 mport is the MidnightBSD Package Manager. |
not reported | — | — | — | 2026-09-17 | 2026-09-21 |
| CVE-2026-77021 Improper handling of highly compressed data (data amplification) in Checkmk <2.5... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-52835 Tautulli is a Python based monitoring and tracking tool for Plex Media Server. |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-77972 Time-of-check Time-of-use (TOCTOU) Race Condition in Slab safeurl allows an atta... |
not reported | — | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-77866 Server-Side Request Forgery (SSRF) vulnerability in Slab safeurl allows an attac... |
not reported | — | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-19407 Bucket Squatting in Google Cloud Gemini Enterprise Agent Platform SDK for Python... |
not reported | — | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-81531 An information
disclosure vulnerability has been identified in Omada Controller. |
not reported | — | — | — | 2026-09-08 | 2026-09-21 |
| CVE-2026-68914 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-77568 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-92612 In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its c... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94373 MISP contains a DOM-based cross-site scripting (XSS) vulnerability in the contex... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94374 MISP contains an insecure direct object reference vulnerability in the processMo... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94379 The login() function in MISP's UsersController.php contained insufficient HTTP m... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94393 When a user creates or edits a report inside an event, MISP can identify an exis... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94372 MISP contains a stored cross-site scripting (XSS) vulnerability in the default t... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94404 MISP has a security issue that could let an attacker change threat-intelligence... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94381 MISP has a security issue that can let a user gain more access than their API ke... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94383 The MISP blocklist workflow module accepted a user-supplied blocklist filename p... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94394 When a regular user adds a reference between objects or attributes, MISP checks... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94401 MISP has a file-handling vulnerability that could let certain authenticated user... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-93884 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94277 MISP's galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp... |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-80219 Rejected reason: Red Hat Product Security has come to the conclusion that this C... |
not reported | — | — | — | 2026-09-08 | 2026-09-21 |
| CVE-2026-90839 Rejected reason: this is rejected |
not reported | — | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-81898 In Concrete CMS below version 9.5.3, the Address attribute's country-less text f... |
not reported | — | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-68532 Concrete CMS 9.0.0 to dashboard group type controller did not validate a CSRF to... |
not reported | — | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-18113 In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape d... |
not reported | — | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-84048 Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file uploa... |
not reported | — | — | — | 2026-09-15 | 2026-09-19 |
| CVE-2026-79954 NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the T... |
not reported | — | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-81301 Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider as... |
not reported | — | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-85628 Transmission of the home Wi-Fi credentials without encryption during the pairing... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-86443 Cleartext storage of sensitive information in the DuoxMe application for Android... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-86474 The lack of TLS certificate validation when downloading firmware updates in VEO... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-86585 The lack of signature verification of firmware update packages in VEO and VEO-XS... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-88260 Authentication bypass using an alternate path or channel and Improper validation... |
not reported | — | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-88261 Improper input validation vulnerability in bizwell xClick allows Stored XSS. |
not reported | — | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-88262 Insufficient session expiration vulnerability in bizwell xClick allows Authentic... |
not reported | — | — | — | 2026-09-15 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.