CVEs published in September 2026
1,795 tracked CVEs from 27 vendors had their first vendor advisory published in September 2026: 291 critical, 1,082 high, 17 in CISA KEV. Newest first.
2,453 more from this month are covered only by Red Hat's per-package records, listed on the Red Hat vendor page.
- Added
CVE-2026-95301High
Missing authorization in Extensions
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-95349Critical
Buffer overflow in WebGL
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-95322Critical
Out of bounds write in GPU
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-95313Critical
Use after free in Fullscreen
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-95284Critical
Buffer overflow in ANGLE
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-95357Critical
Out of bounds write in GPU
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-95339Critical
Use after free in ServiceWorker
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-95281Critical
Buffer overflow in ANGLE
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-95350Critical
Buffer overflow in ANGLE
Palo Alto, Red Hat · 2 advisories - Added
CVE-2026-84784High
Denial of Service via unbounded QUIC connection identifier backlog
NetApp, Red Hat · 2 advisories - Added
CVE-2026-84783High
Denial of Service via race condition in certificate extension caching
NetApp, Red Hat · 2 advisories - Added
CVE-2026-77696Medium
Private key recovery via SM2 timing side-channel
NetApp, Red Hat · 2 advisories - Added
CVE-2026-75806Medium
Denial of Service via undersized DTLS record
NetApp, Red Hat · 2 advisories - Added
CVE-2026-75805Medium
Denial of Service via crafted CMP certificate revocation response
NetApp, Red Hat · 2 advisories - Added
CVE-2026-75804Medium
Denial of Service via unenforced QUIC connection flow control
NetApp, Red Hat · 2 advisories - Added
CVE-2026-72897High
Denial of Service via out-of-bounds write during TLS context switch
NetApp, Red Hat · 2 advisories - Added
CVE-2026-54875Medium
information disclosure via non-constant-time SM2 scalar multiplication on ARM64 and RISC-V
NetApp, Red Hat · 2 advisories - Added
CVE-2026-54873High
Denial of Service via excessive QUIC packet buffer retention
NetApp, Red Hat · 2 advisories - Added
CVE-2026-54872Medium
Private key recovery via timing side-channel in generic elliptic curve operations
NetApp, Red Hat · 2 advisories - Added
CVE-2026-42772Medium
Denial of Service via inefficient QUIC stream reassembly
NetApp, Red Hat · 2 advisories - Added
Traffic amplification Denial of Service via QUIC packet over-accounting
NetApp, Red Hat · 2 advisories - Added
CVE-2026-35189Medium
Denial of Service via excessive memory allocation in CRL distribution point processing
NetApp, Red Hat · 2 advisories - Added
CVE-2026-97395High
Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata
Apache · 1 advisory - Added
CVE-2026-71897Medium
improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on workflows in projects for which they lack the required permissions
Apache · 1 advisory - Added
CVE-2026-71898Medium
incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/{projectCode}/workflow-instances/{id} endpoint
Apache · 1 advisory - Added
CVE-2026-71899Medium
missing authorization vulnerability exists in the `query-dynamic-sub-workflows` API of Apache DolphinScheduler
Apache · 1 advisory - Added
CVE-2026-78214Medium
Apache DolphinScheduler: authentication bypass vulnerability exists in the protection of Actuator endpoints
Apache · 1 advisory - Added
CVE-2026-81569Medium
Apache DolphinScheduler: improper authorization vulnerability exists in the handling of sub-workflow tasks
Apache · 1 advisory - Added
CVE-2026-82804High
Apache DolphinScheduler: The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution
Apache · 1 advisory - Added
CVE-2026-66083Medium
Apache DolphinScheduler: The /datasources/unauth-datasource endpoint does not properly enforce data source authorization
Apache · 1 advisory - Added
CVE-2026-102497High
The Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups
Apache · 1 advisory - Added
CVE-2026-102496High
Denial of Service (DoS) via deeply nested schema structures
Apache, Red Hat · 2 advisories - Added
CVE-2026-102495High
Denial of Service via unbounded recursion during schema parsing
Apache, Red Hat · 2 advisories - Added
CVE-2026-86843Medium
The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templated them straight into the compute-cluster operators, which interpolate those values into Teradata DDL
Apache · 1 advisory - Added
CVE-2026-81930Medium
Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs
Apache · 1 advisory - Added
CVE-2026-81862Medium
Apache Airflow's Teradata provider embedded cloud storage credentials directly into SQL statements
Apache · 1 advisory - Added
CVE-2026-81914Medium
Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them
Apache · 1 advisory - Added
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an unauthenticated user to read CI/CD job trace contents containing sensitive variable values due to improper authorization enforcement in the GraphQL API
GitLab · 1 advisory - Added
CVE-2026-8937Medium
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to read private child issue contents, including titles and descriptions, from projects they had no access to, due to missing authorization checks on linked work items within visible epics
GitLab · 1 advisory - Added
CVE-2026-10518Medium
GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with guest-level permissions to read private security policy content they were not authorized to access due to improper authorization enforcement
GitLab · 1 advisory - Added
CVE-2026-84739High
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user's browser session due to improper sanitization of path components in the merge request diff viewer
GitLab · 1 advisory - Added
CVE-2026-92142High
Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control (RBAC) on MBean operations invoked over the remote JMX connector (RMI registry/server, enabled by default on ports 1099 and 44444)
Apache · 1 advisory - Added
CVE-2026-91085Medium
Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files (etc/org.apache.karaf.command.acl.<scope>.cfg)
Apache · 1 advisory - Added
CVE-2026-91048Critical
The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg
Apache · 1 advisory - Added
CVE-2026-91012Critical
org.apache.karaf.config/org.apache.karaf.config.core: Apache Karaf: Privilege escalation via path traversal in configuration service
Apache, Red Hat · 2 advisories - Added
CVE-2026-102268Critical
PyJWT Vulnerability in NetApp Products
NetApp, Red Hat · 2 advisories - Added
CVE-2026-102267High
Verification key substitution via unvalidated JWKS redirects
NetApp, Red Hat · 2 advisories - Added
CVE-2026-86102Critical
OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system
WatchGuard · 1 advisory - Added
CVE-2026-87969High
OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands by supplying crafted input
WatchGuard · 1 advisory - Added
CVE-2026-101891Critical
improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session
WatchGuard · 1 advisory - Added
CVE-2026-91006High
org.apache.karaf.instance/org.apache.karaf.instance.core: karaf: Apache Karaf: Arbitrary command execution via unquoted instance options
Apache, Red Hat · 2 advisories - Added
CVE-2026-90979High
LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and role lookup by textually substituting the placeholders %u, %dn, and %fqdn (drawn from the login name, the resolved user DN, and its fully qualified namespace form) into administrator-configured filter templates (userFilter, roleFilter)
Apache · 1 advisory - Added
CVE-2026-86507Medium
Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted comment-author URL that can execute script in the session of a weblog moderator or global administrator when the comment management page is viewed
Apache · 1 advisory - Added
CVE-2026-82379High
Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to replay it and gain the victim's AtomPub authority, because the authentication does not enforce nonce uniqueness or timestamp freshness
Apache · 1 advisory - Added
CVE-2026-82380High
Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under the victim's authority, because the CSRF validation filters accept a request that does not submit the required salt token, validating instead against a value the server itself generated for the request
Apache · 1 advisory - Added
CVE-2026-82381Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a user with authoring rights on a weblog to store crafted content that is later written into the authoring UI's JavaScript string literals and markup sinks without proper encoding, causing the stored script to execute in another author's or administrator's browser
Apache · 1 advisory - Added
CVE-2026-82382Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross-site scripting against a visitor to a weblog using the bundled frontpage theme, by supplying a crafted blog-directory parameter that the directory page reflects without proper escaping
Apache · 1 advisory - Added
CVE-2026-82383High
Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuration value (the frontpage weblog selection) on any installed instance, because the setup action remains anonymously reachable after installation and persists configuration without an authorization check
Apache · 1 advisory - Added
CVE-2026-82384Critical
Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are deserialized during request parsing, before authentication
Apache · 1 advisory - Added
CVE-2026-82375High
Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user with entry-editing rights on a weblog to cause outbound HTTP requests to attacker-chosen destinations through legacy outbound Trackback and entry enclosure handling
Apache · 1 advisory - Added
CVE-2026-82376High
Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a user with entry-editing rights on a weblog to cause the server to parse an attacker-influenced trackback response with an XML parser that does not disable external entity resolution, leading to disclosure of files readable by the Roller process
Apache · 1 advisory - Added
CVE-2026-82377Critical
Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the legacy XML-RPC Blogger and MetaWeblog APIs, because the handlers authenticate the caller but do not verify the caller's permission on the weblog or entry actually affected
Apache · 1 advisory - Added
CVE-2026-82378Critical
Incorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an unauthenticated remote attacker who learns an outstanding request token for a configured site-wide consumer to bind that token to an arbitrary user account, including an administrator, by submitting an unsigned authorization request
Apache · 1 advisory - Added
CVE-2026-82385Medium
Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog administrator to read files on the application classpath, including Roller configuration files containing secrets, by authoring a Velocity template that uses an include directive to load a classpath resource outside the theme namespace
Apache · 1 advisory - Added
CVE-2026-82386High
Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog administrator to read files readable by the Roller process and reach internal network addresses by importing a crafted OPML document, because the bookmark import parser does not disable external entity resolution
Apache · 1 advisory - Added
CVE-2026-82348High
Authorization Bypass Through User-Controlled Key in Apache Roller 6.1.5 allows an authenticated user with authoring rights on one weblog to read, modify, or delete resources belonging to another weblog through unscoped identifier-based lookups
Apache · 1 advisory - Added
CVE-2026-82387Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a user with media-upload rights to store active content on Roller's origin, because the media upload feature trusts the upload-supplied content type and serves the stored file back with that type
Apache · 1 advisory - Added
CVE-2026-82546Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an unauthenticated remote attacker to store a crafted comment-author URL through the incoming Trackback endpoint when a published entry accepts comments and Trackbacks
Apache · 1 advisory - Added
CVE-2026-91204Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an anonymous remote attacker to store a comment containing a javascript: URI link that survives HTML comment formatting and can execute script in the browser of a visitor who clicks it
Apache · 1 advisory - Added
CVE-2026-91206Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross-site scripting through the optional LDAP comment authenticator, which writes request parameter values into its HTML form without escaping
Apache · 1 advisory - Added
CVE-2026-88778High
TCP Initial Sequence Number (ISN) prediction
NetScaler · 2 advisories - Added
CVE-2026-88777High
Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service
NetScaler · 2 advisories - Added
CVE-2026-88776High
Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service
NetScaler · 2 advisories - Added
CVE-2026-88775High
Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service
NetScaler · 2 advisories - Added
CVE-2026-88774High
Feature policy bypass due to improper HTTP URL based expression usage
NetScaler · 2 advisories - Added
CVE-2026-88773Critical
HTTP Request Smuggling
NetScaler · 2 advisories - Added
CVE-2026-88772CriticalCISA KEV
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
NetScaler · 2 advisories - Added
CVE-2026-88771CriticalCISA KEV
Citrix NetScaler Improper Input Validation Vulnerability
NetScaler · 2 advisories - Added
CVE-2026-78902Medium
Cross Site Scripting vulnerability in Netgate pfSense 26.03.1-RELEASE allows an attacker to execute arbitrary code via the pfBlockerNG package
pfSense · 1 advisory - Added
CVE-2026-92550High
org.apache.qpid/qpid-broker-plugins-amqp-0-8-protocol: Apache Qpid Broker-J: Denial of Service via excessive memory allocation in AMQP decoder
Apache, Red Hat · 2 advisories - Added
CVE-2026-92560High
org.apache.qpid/qpid-broker-plugins-amqp-0-10-protocol: Apache Qpid Broker-J: Denial of Service via excessive memory allocation in AMQP 0-10 decoder
Apache, Red Hat · 2 advisories - Added
CVE-2026-92573Medium
Apache Qpid Broker-J: Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion and HTTP management JSON rendering allows authenticated message producers to exhaust memory and disrupt broker availability via processing without a decompressed-output limit
Apache · 1 advisory - Added
CVE-2026-92564High
org.apache.qpid/qpid-broker-plugins-amqp-0-8-protocol: Apache Qpid Broker-J: Denial of Service via unbounded type nesting
Apache, Red Hat · 2 advisories - Added
CVE-2026-92608High
Apache Qpid Broker-J: Improper handling of property-encoding exceptions in AMQP 1.0-to-AMQP 0-10 message conversion allows authenticated message producers to disrupt delivery to AMQP 0-10 consumers via message properties that the target encoder does not handle correctly
Apache · 1 advisory - Added
CVE-2026-92609Critical
org.apache.qpid/qpid-broker-plugins-management-http: Apache Qpid Broker-J: Unauthorized management session access via session fixation
Apache, Red Hat · 2 advisories - Added
CVE-2026-97730High
In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code
pfSense · 1 advisory - Added
CVE-2026-48937High
Node.js Vulnerability in NetApp Products
NetApp · 1 advisory - Added
CVE-2026-48617High
Node.js Vulnerability in NetApp Products
NetApp · 1 advisory - Added
CVE-2026-23255Medium
Linux Kernel Vulnerability in NetApp Products
NetApp · 1 advisory - Added
CVE-2026-11824High
SQLite Vulnerability in NetApp Products
NetApp · 1 advisory - Added
CVE-2026-11822High
SQLite Vulnerability in NetApp Products
NetApp · 1 advisory - Added
CVE-2026-100075Critical
Fix srpt_alloc_rw_ctxs unwind counters
NetApp, Red Hat · 2 advisories - Added
CVE-2025-68823Medium
Linux Kernel Vulnerability in NetApp Products
NetApp · 1 advisory - Added
CVE-2025-40347High
Linux Kernel Vulnerability in NetApp Products
NetApp · 1 advisory - Added
CVE-2025-39997Medium
Linux Kernel Vulnerability in NetApp Products
NetApp · 1 advisory - Added
CVE-2025-38710High
Linux Kernel Vulnerability in NetApp Products
NetApp · 1 advisory - Added
CVE-2025-38627High
Linux Kernel Vulnerability in NetApp Products
NetApp · 1 advisory - Added
CVE-2025-38584High
Linux Kernel Vulnerability in NetApp Products
NetApp · 1 advisory - Added
CVE-2025-37864Medium
Linux Kernel Vulnerability in NetApp Products
NetApp · 1 advisory - Added
CVE-2025-22105Medium
Linux Kernel Vulnerability in NetApp Products
NetApp · 1 advisory