September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87087 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-85588 phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext wit... |
not reported | — | — | — | 2026-09-04 | 2026-09-14 |
| CVE-2026-80878 In the Linux kernel, the following vulnerability has been resolved:
afs: Fix le... |
not reported | — | — | — | 2026-09-04 | 2026-09-14 |
| CVE-2026-80888 In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx:... |
not reported | — | — | — | 2026-09-04 | 2026-09-14 |
| CVE-2026-80912 In the Linux kernel, the following vulnerability has been resolved:
selinux: re... |
not reported | — | — | — | 2026-09-04 | 2026-09-14 |
| CVE-2026-49030 Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-09-13 | 2026-09-13 |
| CVE-2026-81908 Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in the... |
not reported | — | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-68528 Concrete CMS RSS Displayer block below version 9.5.3 rendered remote feed item t... |
not reported | — | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-18122 Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Ex... |
not reported | — | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-81909 Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the block... |
not reported | — | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-87983 An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.... |
not reported | — | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-87984 An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3... |
not reported | — | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-87985 An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to... |
not reported | — | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-87986 An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to... |
not reported | — | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-87987 An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to... |
not reported | — | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-87988 An arbitrary file access vulnerability in Mistral Vibe allows an attacker to byp... |
not reported | — | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-87122 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-76652 An
authenticated directory traversal vulnerability in file upload functionality... |
not reported | — | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-76653 A missing
authentication vulnerability in the VPN configuration management has b... |
not reported | — | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-84941 An information disclosure vulnerability in the SAML Single Sign-On (SSO) functio... |
not reported | — | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-81906 Concrete CMS OAuth callback login path prior to version 9.5.3 did not check whet... |
not reported | — | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-81905 Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes (em... |
not reported | — | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-18121 Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass (IDOR) bec... |
not reported | — | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-19486 A Server-Side Request Forgery (SSRF) vulnerability in Google Cloud Gemini Enterp... |
not reported | — | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-11573 Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path... |
not reported | — | — | — | 2026-09-08 | 2026-09-11 |
| CVE-2026-0307 Multiple local privilege escalation vulnerabilities in the Palo Alto Networks Gl... |
not reported | — | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-0304 A privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM... |
not reported | — | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-19820 A vulnerability in the Backblaze Client allows a local user to make the system n... |
not reported | — | — | — | 2026-09-01 | 2026-09-11 |
| CVE-2026-84432 Concrete CMS 9 through 9.5.2 did not validate an anti-CSRF token in the Boards c... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-53933 Maravel, a PHP framework oriented towards dependency injection, prior to version... |
not reported | — | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-55250 Maravel, a PHP framework oriented towards dependency injection, prior to version... |
not reported | — | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-17038 DrEryk Gabinet before 11.5.0 uses hard-coded API credentials in its ticket repor... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-68527 Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authorization byp... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-65638 Improper escaping of a request URL in ConfigServer Security & Firewall allows an... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-65639 OS command injection in the advanced-rule parser of ConfigServer Security & Fire... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-15417 In the silabser.sys Windows 8 driver for CP210x devices, a local unprivileged us... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-15418 In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unpri... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-15419 In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unpri... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88915 Affected versions of MISP do not consistently enforce the acting user's authoriz... |
not reported | — | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-50165 alf.io is an open source ticket reservation system for conferences, trade shows,... |
not reported | — | — | — | 2026-09-09 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.