September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84712 A flaw was found in the automation-controller API. |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-97177 A flaw was found in the user update mechanism of the Keycloak Admin REST API. |
medium | 6.6 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97311 A flaw was found in the Admin REST API of Keycloak, an identity and access manag... |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-77798 Velociraptor contains a deadlock condition that may be triggered by authenticate... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-93541 An out-of-bounds read in libXi's XQueryDeviceState() in libXi before 1.8.4 could... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-93542 An out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_c... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-93544 An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in libXi before... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-93545 An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-94281 An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi befo... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96748 PyMongo's connection string parsing decodes percent-encoded characters in the ho... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-91987 atomic-agents-stack before 1.1.0 contains a cost-guardrail bypass in the _estima... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-92459 yshop-crm through 2.1.3 contains a missing authorization vulnerability in the Cr... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92765 ArcherySec through 2.0.6 fails to validate organization ownership in the WebScan... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92790 Higress before 2.2.4 panics when processing a Cookie header segment without an e... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92795 Coze Studio through 0.5.1 fails to restrict the server URL supplied when registe... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-94054 Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled pro... |
medium | 5.3 | — | Exim / exim | 2026-09-19 | 2026-09-24 |
| CVE-2026-90781 alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_asci... |
medium | 4.4 | — | — | 2026-09-13 | 2026-09-24 |
| CVE-2026-92774 Wiki.js through 2.5.314 omits page tags from authorization checks in multiple Gr... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-94055 Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS,... |
medium | 5.3 | — | Exim / exim | 2026-09-19 | 2026-09-24 |
| CVE-2026-90928 File Browser through 2.63.23 contains a memory exhaustion vulnerability in the s... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-90930 File Browser through 2.63.23 applies path rules to the requested lexical path bu... |
medium | 6.8 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-89020 MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-91197 Flowable flowable-engine through 8.0.0 contains an XML external entity injection... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-56719 MikroTik RouterOS before 7.24 contains an out-of-bounds read vulnerability in th... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-84809 Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode... |
medium | 6.5 | — | — | 2026-09-02 | 2026-09-24 |
| CVE-2026-82521 parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an outp... |
medium | 5.3 | — | — | 2026-09-03 | 2026-09-24 |
| CVE-2026-85621 LobeChat (LobeHub) 2.2.1 does not properly verify inbound chat-platform webhook... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-24 |
| CVE-2026-85693 Chatbot UI contains an authorization bypass vulnerability in the retrieval endpo... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-24 |
| CVE-2026-85697 Documenso 2.17.0 contains an access control vulnerability in the PDF-serving end... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-24 |
| CVE-2026-86116 Metabase versions before 0.63.1 fail to enforce data analyst permission checks o... |
medium | 6.5 | — | — | 2026-09-05 | 2026-09-24 |
| CVE-2026-89145 Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin dir... |
medium | 4.2 | — | — | 2026-09-11 | 2026-09-24 |
| CVE-2026-82535 Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vuln... |
medium | 6.1 | — | — | 2026-09-11 | 2026-09-24 |
| CVE-2026-91922 Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scriptin... |
medium | 6.1 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-91997 evolution-api through 2.3.7 contains an incorrect array comparison in the metric... |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-89030 Adenion Blog2Social plugin for WordPress before 9.1.0 exposes the email addresse... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-94057 Exim before 4.100.1 allows SMTP smuggling in which the received message does not... |
medium | 5.3 | — | Exim / exim | 2026-09-19 | 2026-09-24 |
| CVE-2026-90927 filebrowser through 2.63.23 fails to limit WebSocket message size in the /api/co... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-85670 tokenizers (Hugging Face) is affected by an out-of-bounds buffer access in BpeBu... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-24 |
| CVE-2026-7208 Yealink SIP-T33G firmware versions 124.86.x.x prior to 124.87.0.0 contain a race... |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-82019 TripleLift's ad rendering script (video-bundle.js) contains a DOM-based cross-si... |
medium | 4.2 | — | — | 2026-09-14 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.