September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-78043 The Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-78221 An incorrect buffer size calculation in the Windows Interactive Service in OpenV... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-81738 OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows atta... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-81830 The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local aut... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-82312 OpenVPN 2.0.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows loca... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-84226 OpenVPN version 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows all... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-84732 Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remot... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-82325 A use-after-free vulnerability in the OpenVPN ovpn-dco-win driver version 2.5.0... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-85201 In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the le... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-84173 In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interf... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-33197 AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause th... |
not reported | — | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-19204 A client may send a WebSocket frame with an unknown opcode and a very large decl... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-15431 A potential security vulnerability has been identified in the HP Support
Assist... |
not reported | — | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-82753 Allocation of Resources Without Limits or Throttling vulnerability in ash-projec... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-82754 Improper Protection of Alternate Path vulnerability in ash-project ash_authentic... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-82755 Use of Cache Containing Sensitive Information vulnerability in ash-project ash_a... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-82756 Improper Encoding or Escaping of Output vulnerability in ash-project ash_authent... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-82757 Server-Side Request Forgery (SSRF) vulnerability in ash-project ash_authenticati... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-82758 Improper Authentication vulnerability in ash-project ash_authentication_oauth2_s... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-81638 Improper Handling of Alternate Encoding vulnerability in ash-project ash_double_... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-82586 Improper Protection of Alternate Path vulnerability in ash-project ash_lua allow... |
not reported | — | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-82710 Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in a... |
not reported | — | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-19203 A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server... |
not reported | — | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-4644 A Missing Authorization vulnerability in HTTP Connector in Google Cloud Integrat... |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-79707 A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Dev... |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-82728 Allocation of Resources Without Limits or Throttling vulnerability in elixir-min... |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-82729 Inefficient Algorithmic Complexity vulnerability in elixir-mint mint allows a re... |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-86590 In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /da... |
not reported | — | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-85242 PlaywrightCapture contains a server-side request forgery (SSRF) vulnerability in... |
not reported | — | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85533 An authorization flaw in MISP allowed an authenticated user to submit a sharing_... |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85538 An incorrect authorization vulnerability in MISP allowed authenticated users to... |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85547 A cross-site request forgery (CSRF) vulnerability exists in MISP due to form-sec... |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-15937 Improper certificate validation in Checkmk <2.5.0p10 allows a relay and a push a... |
not reported | — | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-15933 OptimiDoc Server (On-Premise) stores credentials for external services in cleart... |
not reported | — | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-77654 Improper Privilege Management vulnerability in Horizon Security Analyzer (former... |
not reported | — | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-74994 The mod_auth module in OTP's inets httpd server, when configured with dets or mn... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-75538 An attacker that connects to an open Erlang TCP port that uses the inet driver w... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-73812 httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-239... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-74835 The inets application HTTP server httpd fails to enforce a configured body-size... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-70409 Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP e... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.