September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-80871 In the Linux kernel, the following vulnerability has been resolved:
crypto: xil... |
not reported | — | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-80872 In the Linux kernel, the following vulnerability has been resolved:
ALSA: hda/t... |
not reported | — | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-80873 In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64:... |
not reported | — | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-80874 In the Linux kernel, the following vulnerability has been resolved:
arm64: dts:... |
not reported | — | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-80875 In the Linux kernel, the following vulnerability has been resolved:
ipvs: use p... |
not reported | — | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-80876 In the Linux kernel, the following vulnerability has been resolved:
ring-buffer... |
not reported | — | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-80877 In the Linux kernel, the following vulnerability has been resolved:
afs: Fix vl... |
not reported | — | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-80865 In the Linux kernel, the following vulnerability has been resolved:
bpf: Add mi... |
not reported | — | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-80867 In the Linux kernel, the following vulnerability has been resolved:
alpha/PCI:... |
not reported | — | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-80868 In the Linux kernel, the following vulnerability has been resolved:
ntfs3: Allo... |
not reported | — | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-80869 In the Linux kernel, the following vulnerability has been resolved:
ntfs: bound... |
not reported | — | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-80870 In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd:... |
not reported | — | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-80820 In the Linux kernel, the following vulnerability has been resolved:
xfs: don't... |
not reported | — | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-80784 In the Linux kernel, the following vulnerability has been resolved:
mptcp: pm:... |
not reported | — | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-80776 In the Linux kernel, the following vulnerability has been resolved:
futex: Fix... |
not reported | — | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-84736 In the current development version of Eclipse aeriOS, for which no official rele... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-76174 Unrestricted file upload vulnerability in the CSV file upload functionality of t... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-76175 SQL injection vulnerability in the del_check parameter of the /ocsreports/?funct... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-76176 SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admin... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-76177 Server-Side Request Forgery (SSRF) vulnerability in the /ocsreports/?function=te... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-76178 A stored Cross-Site Scripting (XSS) vulnerability in the notification template f... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84830 SEPPmail Secure Email Gateway before 15.0.7 contains a command injection vulnera... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84831 SEPPmail Secure Email Gateway before 15.0.7 creates a fully privileged session b... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-6071 A remote code execution security issue exists in the affected products when pars... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-79990 Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIdd... |
not reported | — | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-79991 Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIdd... |
not reported | — | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-77999 Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery lead... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-78000 Joomla Extension - j2commerce.com - Reflected XSS via `filter_tag`, `pricefrom`... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-78064 Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherite... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-78065 Joomla Extension - j2commerce.com - Guest checkout address disclosure to any aut... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-78069 Joomla Extension - j2commerce.com - Missing authorization on Apps controller del... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-78080 Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Li... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-67394 A critical local privilege escalation via OS command injection vulnerability has... |
not reported | — | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-78319 A service running on the affected products contains a potential Time-of-Check Ti... |
not reported | — | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-84175 In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of... |
not reported | — | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-82958 In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper... |
not reported | — | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-82955 In the current development version of Eclipse aeriOS, which has not yet had an o... |
not reported | — | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-80515 In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization g... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-82180 In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled w... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-85199 Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversa... |
not reported | — | — | — | 2026-09-03 | 2026-09-03 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.