September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,791
Medium
4,833
Low
527
Severity not reported
2,536
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (328), apple (245), ibm (235), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (89)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-77825 IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversa... |
medium | 4.9 | — | Ibm / contextforge | 2026-09-24 | 2026-09-29 |
| CVE-2026-6544 IBM Concert 1.0.0 through 3.0.0 allows recursive copying of directories without... |
medium | 6.2 | — | Ibm / concert | 2026-09-24 | 2026-09-28 |
| CVE-2026-18870 IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31,... |
medium | 4.3 | — | Ibm / power system s1122 \(9824-22a\) firmware | 2026-09-24 | 2026-09-30 |
| CVE-2026-17503 IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31,... |
medium | 5.1 | — | Ibm / power system s1122 \(9824-22a\) firmware | 2026-09-24 | 2026-09-30 |
| CVE-2026-17504 IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31,... |
medium | 4.4 | — | Ibm / power system s1122 \(9824-22a\) firmware | 2026-09-24 | 2026-09-29 |
| CVE-2026-17413 IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31,... |
medium | 5.1 | — | Ibm / power system s1122 \(9824-22a\) firmware | 2026-09-24 | 2026-09-30 |
| CVE-2026-80423 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
medium | 6.5 | — | Ibm / datastage on cloud pak for data | 2026-09-23 | 2026-10-06 |
| CVE-2026-6925 IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to traverse direct... |
medium | 5.3 | — | Ibm / concert | 2026-09-23 | 2026-09-28 |
| CVE-2026-6718 IBM Concert 1.0.0 through 3.0.0 is vulnerable to improper access control which a... |
medium | 6.2 | — | Ibm / concert | 2026-09-23 | 2026-09-28 |
| CVE-2026-3626 IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to obtain sensitiv... |
medium | 5.3 | — | Ibm / concert | 2026-09-23 | 2026-09-28 |
| CVE-2026-6327 IBM Concert 1.0.0 through 3.0.0 could allow an unauthorized user to inject data... |
medium | 4.3 | — | Ibm / concert | 2026-09-23 | 2026-09-28 |
| CVE-2026-19267 IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to mi... |
medium | 6.2 | — | Ibm / financial transaction manager | 2026-09-23 | 2026-10-07 |
| CVE-2026-18505 IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to op... |
medium | 5.4 | — | Ibm / financial transaction manager | 2026-09-23 | 2026-10-07 |
| CVE-2026-19087 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local... |
medium | 4.4 | — | Ibm / financial transaction manager | 2026-09-23 | 2026-10-07 |
| CVE-2026-18180 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
medium | 6.5 | — | Ibm / financial transaction manager | 2026-09-23 | 2026-10-07 |
| CVE-2026-18179 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
medium | 6.5 | — | Ibm / financial transaction manager | 2026-09-23 | 2026-10-07 |
| CVE-2026-18170 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
medium | 6.5 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-06 |
| CVE-2026-18161 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
medium | 4.3 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-06 |
| CVE-2026-18132 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
medium | 6.5 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-07 |
| CVE-2026-18133 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
medium | 6.5 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-07 |
| CVE-2026-18156 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
medium | 6.5 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-08 |
| CVE-2026-18124 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local... |
medium | 6.5 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-07 |
| CVE-2026-18131 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
medium | 6.1 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-07 |
| CVE-2026-17646 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
medium | 6.5 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-08 |
| CVE-2026-17465 IBM Concert 1.0.0 through 3.0.0 could allow a remote authenticated attacker to c... |
medium | 6.5 | — | Ibm / concert | 2026-09-22 | 2026-11-03 |
| CVE-2026-15915 IBM Concert 1.0.0 through 3.0.0 could allow a local attacker to obtain sensitive... |
medium | 5.5 | — | Ibm / concert | 2026-09-22 | 2026-11-03 |
| CVE-2026-16426 IBM Concert 1.0.0 through 3.0.0 is vulnerable to server-side request forgery (SS... |
medium | 5.4 | — | Ibm / concert | 2026-09-22 | 2026-11-03 |
| CVE-2025-12767 IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to cause a denial... |
medium | 5.3 | — | Ibm / concert | 2026-09-22 | 2026-11-03 |
| CVE-2026-82890 IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to... |
medium | 5.9 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-11538 IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vuln... |
medium | 5.3 | — | Ibm / websphere application server | 2026-09-18 | 2026-09-24 |
| CVE-2026-12751 IBM Cloud Pak for Business Automation is vulnerable to HTML injection. |
medium | 5.4 | — | Ibm / cloud pak for business automation | 2026-09-15 | 2026-09-23 |
| CVE-2026-12749 IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripti... |
medium | 5.4 | — | Ibm / cloud pak for business automation | 2026-09-15 | 2026-09-23 |
| CVE-2026-12750 IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripti... |
medium | 5.4 | — | Ibm / cloud pak for business automation | 2026-09-15 | 2026-09-23 |
| CVE-2026-16432 IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage PxXMLInput operator co... |
medium | 6.5 | — | Ibm / datastage on cloud pak for data | 2026-09-14 | 2026-10-06 |
| CVE-2026-82100 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
medium | 6.5 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-86087 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an authenti... |
medium | 4.3 | — | Ibm / db2 | 2026-09-10 | 2026-09-14 |
| CVE-2026-82092 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
medium | 6.5 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-81554 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
medium | 6.5 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-80434 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
medium | 5.0 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-80378 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
medium | 6.5 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.