September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-91994 Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-81912 Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Mov... |
medium | 5.7 | — | Concretecms / concrete cms | 2026-09-11 | 2026-09-24 |
| CVE-2026-48073 Docmost is open-source collaborative wiki and documentation software. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-65827 Docmost is open-source collaborative wiki and documentation software. |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-81913 Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via th... |
medium | 6.1 | — | Concretecms / concrete cms | 2026-09-11 | 2026-09-24 |
| CVE-2026-81915 Concrete CMS below 9.5.3 does not perform an object-level authorization check wh... |
medium | 5.3 | — | Concretecms / concrete cms | 2026-09-11 | 2026-09-24 |
| CVE-2026-68535 Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not... |
medium | 4.3 | — | Concretecms / concrete cms | 2026-09-11 | 2026-09-24 |
| CVE-2026-70575 Null pointer dereference in Windows Schannel allows an authorized attacker to de... |
medium | 6.5 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-24 |
| CVE-2026-76902 CordysCRM is an open source AI-powered customer relationship management system t... |
medium | 5.0 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-78310 Authorization Bypass Through User-Controlled Key in DIAEnergie. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-78313 Improper Access Control in DIAEnergie. |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-79758 Termix is a web-based server management platform with SSH terminal, tunneling, a... |
medium | 5.4 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-79763 Termix is a web-based server management platform with SSH terminal, tunneling, a... |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-65422 A flaw in the authorization mechanism for Media Gateway API in Genetec Security... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-19532 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-88916 Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Privileg... |
medium | 6.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-77703 Key exchange without entity authentication vulnerability in HAVELSAN Inc. |
medium | 5.9 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-77707 Improper certificate validation vulnerability in HAVELSAN Inc. |
medium | 5.9 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-48072 Docmost is open-source collaborative wiki and documentation software. |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97226 A vulnerability has been found in DbGate up to 7.2.5/7.3.1-premium-beta.1. |
medium | 6.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-91133 Discourse is an open-source discussion platform. |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-91120 Discourse is an open-source discussion platform. |
medium | 5.4 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-91121 Discourse is an open-source discussion platform. |
medium | 5.0 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-84302 Discourse is an open-source discussion platform. |
medium | 4.2 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-47132 phpMyFAQ is an open source FAQ web application. |
medium | 5.4 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-69531 Unintended proxy or intermediary ('confused deputy') in Microsoft Windows Speech... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-97179 A security vulnerability has been detected in O2OA up to 9.5.3/10.0.2. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96772 A security flaw has been discovered in Intelliants Subrion CMS up to 4.2.1. |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-84716 A flaw was found in the automation-controller instance
install-bundle endpoint. |
medium | 6.6 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-18335 The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordP... |
medium | 5.4 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-4806 The Custom Thank You Page for WooCommerce plugin for WordPress is vulnerable to... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-93763 A protection mechanism failure in the object-document mapper's encryption config... |
medium | 6.5 | — | Mongodb / mongoid | 2026-09-18 | 2026-09-24 |
| CVE-2026-93764 Mongoid may omit encryption rules for fields declared on embedded models when ge... |
medium | 6.5 | — | Mongodb / mongoid | 2026-09-18 | 2026-09-24 |
| CVE-2026-11538 IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vuln... |
medium | 5.3 | — | Ibm / websphere application server | 2026-09-18 | 2026-09-24 |
| CVE-2026-55256 In parsePartHeaders of multiple files, there is a possible persistent denial of... |
medium | 6.5 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-92756 Applications built on MongoDB Entity Framework Core Provider which combine indep... |
medium | 5.5 | — | Mongodb / entity framework core provider | 2026-09-17 | 2026-09-24 |
| CVE-2026-92758 If logging mode is set to DEBUG or a malformed MongoDB connection string is used... |
medium | 5.5 | — | Mongodb / entity framework core provider | 2026-09-17 | 2026-09-24 |
| CVE-2026-92757 Applications built on MongoDB Entity Framework Core Provider which place a datab... |
medium | 5.5 | — | Mongodb / entity framework core provider | 2026-09-17 | 2026-09-24 |
| CVE-2026-45527 In convertCleanApertureToRect of HeifCleanAperture.cpp, there is a possible way... |
medium | 4.3 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-96551 A vulnerability was determined in sfturing hosp_order up to 627f426331da8086ce8f... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.