September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,133
Critical
1,210
High
4,300
Medium
4,026
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-82760 Inefficient Algorithmic Complexity vulnerability in team-alembic AshAuthenticati... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-82761 Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in team-alembic... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-85500 Authentication Bypass by Primary Weakness vulnerability in team-alembic AshAuthe... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-86522 Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthent... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-86533 Insufficient Session Expiration vulnerability in team-alembic AshAuthentication... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-88952 Improper Authentication vulnerability in team-alembic AshAuthentication allows a... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-91039 Authentication Bypass by Spoofing vulnerability in team-alembic ash_authenticati... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-76949 Authentication Bypass by Spoofing vulnerability in team-alembic ash_authenticati... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-86688 Session Fixation vulnerability in team-alembic ash_authentication allows an atta... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-92932 In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/U... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-15600 Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL... |
not reported | — | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-7848 Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL... |
not reported | — | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-92808 A server-side request forgery (SSRF) vulnerability exists in the UnifiedLogin se... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-50603 A vulnerability has been identified in the Acer Agent Service component included... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-50604 A vulnerability has been identified in the Acer Agent Service component included... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-50605 A vulnerability has been identified in the Acer Agent Service component included... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-50606 A vulnerability has been identified in the Acer System Monitoring component incl... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-50607 A vulnerability has been identified in the Acer System Monitoring component incl... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-50608 A vulnerability has been identified in the Acer System Monitoring component incl... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-50609 A vulnerability has been identified in the Acer System Monitoring component incl... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-50610 A vulnerability has been identified in the Acer System Monitoring component incl... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-54576 mport is the MidnightBSD Package Manager. |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-54578 mport is the MidnightBSD Package Manager. |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-54507 Vvveb is a powerful and easy to use CMS with page builder to build websites, blo... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-89418 google-protobuf contains an unbounded recursion when parsing unknown protobuf gr... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-78668 Rejected reason: reserved but not needed |
not reported | — | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-54581 mport is the MidnightBSD Package Manager. |
not reported | — | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-54582 mport is the MidnightBSD Package Manager. |
not reported | — | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-54583 mport is the MidnightBSD Package Manager. |
not reported | — | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-54585 mport is the MidnightBSD Package Manager. |
not reported | — | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-54587 mport is the MidnightBSD Package Manager. |
not reported | — | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-73177 Nozomi Networks Labs identified a CWE-345: Insufficient Verification of Data Aut... |
not reported | — | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-92962 vm2 is a sandbox for running untrusted JavaScript. |
not reported | — | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-53681 Rejected reason: Red Hat Product Security has come to the conclusion that this C... |
not reported | — | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-53679 Rejected reason: Red Hat Product Security has come to the conclusion that this C... |
not reported | — | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-21586 This High severity Improper Authorization vulnerability was introduced in versio... |
not reported | — | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-21587 This High severity Improper Authorization vulnerability was introduced in versio... |
not reported | — | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-11874 Rejected reason: Red Hat Product Security has come to the conclusion that this C... |
not reported | — | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-75754 Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF)... |
not reported | — | — | — | 2026-09-04 | 2026-09-17 |
| CVE-2026-16003 Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a... |
not reported | — | — | — | 2026-09-08 | 2026-09-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.