September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-79759 Termix is a web-based server management platform with SSH terminal, tunneling, a... |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-57176 Python Social Auth is a social authentication/registration mechanism. |
medium | 6.8 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-96672 Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Te... |
medium | 6.4 | — | — | 2026-09-23 | 2026-09-29 |
| CVE-2026-92164 Streamlink is a CLI utility which pipes video streams from various services into... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-29 |
| CVE-2026-84852 A security vulnerability has been detected in Reader Tools PDF Reader App 98.8 o... |
medium | 4.4 | — | — | 2026-09-02 | 2026-09-28 |
| CVE-2026-84856 A vulnerability was detected in rowboatlabs rowboat up to 0.9.1. |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-28 |
| CVE-2026-84857 A flaw has been found in sigoden aichat up to 0.30.4. |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-28 |
| CVE-2026-86239 A vulnerability was identified in liufee FeehiCMS up to 2.1.1. |
medium | 5.3 | — | — | 2026-09-07 | 2026-09-28 |
| CVE-2026-86240 A security flaw has been discovered in liufee FeehiCMS up to 2.1.1. |
medium | 4.7 | — | — | 2026-09-07 | 2026-09-28 |
| CVE-2026-86241 A weakness has been identified in liufee FeehiCMS up to 2.1.1. |
medium | 4.3 | — | — | 2026-09-07 | 2026-09-28 |
| CVE-2026-86244 A security vulnerability has been detected in FastAdmin up to 1.2.0.20210401_bet... |
medium | 4.3 | — | — | 2026-09-07 | 2026-09-28 |
| CVE-2026-86260 A security flaw has been discovered in sfturing hosp_order up to 627f426331da808... |
medium | 6.5 | — | — | 2026-09-07 | 2026-09-28 |
| CVE-2026-86264 A flaw has been found in sfturing ssm_pro up to 627f426331da8086ce8fff2017d65b1d... |
medium | 4.3 | — | — | 2026-09-07 | 2026-09-28 |
| CVE-2026-86314 Integer overflow in the source-bounds check in Memory::init() (src/runtime/Memor... |
medium | 6.2 | — | — | 2026-09-07 | 2026-09-28 |
| CVE-2026-86267 A security vulnerability has been detected in itsourcecode Information System So... |
medium | 6.3 | — | — | 2026-09-07 | 2026-09-28 |
| CVE-2026-86315 An out-of-bounds write caused by numeric truncation Samsung Open Source Escargot... |
medium | 6.2 | — | — | 2026-09-07 | 2026-09-28 |
| CVE-2026-86511 A vulnerability was found in java-json-tools jackson-coreutils 2.0. |
medium | 5.3 | — | — | 2026-09-08 | 2026-09-28 |
| CVE-2026-86512 A vulnerability was identified in java-json-tools json-patch up to 1.13. |
medium | 6.3 | — | — | 2026-09-08 | 2026-09-28 |
| CVE-2026-86513 A security flaw has been discovered in java-json-tools jackson-coreutils 2.0. |
medium | 5.3 | — | — | 2026-09-08 | 2026-09-28 |
| CVE-2026-86514 A weakness has been identified in vgmstream up to r2117. |
medium | 6.3 | — | — | 2026-09-08 | 2026-09-28 |
| CVE-2026-86515 A security vulnerability has been detected in vgmstream up to r2117. |
medium | 4.3 | — | — | 2026-09-08 | 2026-09-28 |
| CVE-2026-86518 A vulnerability has been found in code-projects Student Crud Operation 1.0. |
medium | 6.3 | — | — | 2026-09-08 | 2026-09-28 |
| CVE-2026-92356 A vulnerability was determined in a2ui-project a2ui 0.9/0.9.1. |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-28 |
| CVE-2026-92357 A vulnerability was identified in a2ui-project a2ui 0.8/0.9/1.0. |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-28 |
| CVE-2026-97686 Wind River VxWorks 7 prior to 26.09, specific system call arguments can result i... |
medium | 5.5 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-77516 MaxKB is an open-source AI assistant for enterprise. |
medium | 5.4 | — | — | 2026-09-21 | 2026-09-28 |
| CVE-2026-92361 A security vulnerability has been detected in ag-ui-protocol ag-ui 1.0. |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-28 |
| CVE-2026-101078 A vulnerability has been found in deepseek-ai deepseek-harness up to 0.1.7-rc.2. |
medium | 6.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101080 A vulnerability was identified in Tencent AI-Infra-Guard up to 4.5.2/4.6.2. |
medium | 4.8 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101083 A security vulnerability has been detected in PMWeb v7.x/v8.x/v2025.x. |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101098 A security vulnerability has been detected in ag-ui-protocol ag-ui up to 2026-09... |
medium | 4.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101100 A flaw has been found in ag-ui-protocol ag-ui up to 2026-09-07. |
medium | 5.4 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101101 A vulnerability has been found in ag-ui-protocol ag-ui up to 2026-09-07. |
medium | 4.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101105 A vulnerability was determined in code-projects Matrimonial System 1.0. |
medium | 6.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100853 In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to veri... |
medium | 5.9 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-101049 Heym before 0.0.53 fails to verify Slack request signatures when trigger nodes l... |
medium | 6.5 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-101063 Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endp... |
medium | 5.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-101086 Nezha Dashboard versions before 2.3.5 fail to restrict service monitor task type... |
medium | 6.5 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100628 capgo.app before 12.128.12 fails to enforce an organization's API key expiration... |
medium | 4.3 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100860 heym before 0.0.105 does not act on the result of the credential authorization l... |
medium | 5.5 | — | — | 2026-09-27 | 2026-09-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.