September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-50022 Metacat is data repository software that helps researchers preserve, share, and... |
medium | 5.8 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-62282 OpenCVE is a vulnerability intelligence platform. |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-93750 http-cache-semantics through 4.2.0 contains a cache validation vulnerability in... |
medium | 5.9 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-92565 Rallly before 4.15.0 contains an information disclosure vulnerability in the pol... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92568 MLRun through 1.11.0 contains a server-side request forgery vulnerability in the... |
medium | 5.4 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92600 Guns through 8.3.5 contains an information disclosure vulnerability in SysUserCo... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92760 Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mer... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92771 Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-89267 starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchable_fi... |
medium | 4.3 | — | — | 2026-09-12 | 2026-09-23 |
| CVE-2026-89268 QloApps through 1.7.0 renders back-office list filter POST parameters into HTML... |
medium | 5.4 | — | — | 2026-09-12 | 2026-09-23 |
| CVE-2026-90472 msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUn... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-23 |
| CVE-2026-90473 msgpack-java through 0.9.12 contains an integer overflow vulnerability in Messag... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-23 |
| CVE-2026-90474 MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embe... |
medium | 6.8 | — | — | 2026-09-12 | 2026-09-23 |
| CVE-2026-90557 Freeciv versions 3.1.0 through 3.2.5 contain an out-of-bounds read vulnerability... |
medium | 6.1 | — | — | 2026-09-12 | 2026-09-23 |
| CVE-2026-90934 EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in th... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-90939 novel-plus through 5.3.3 contains an information disclosure vulnerability in the... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-90941 novel-plus through 5.3.3 contains an authorization bypass vulnerability in the B... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-91081 Docs through 5.6.1 contains a server-side request forgery vulnerability in the c... |
medium | 5.8 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-91146 Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federat... |
medium | 6.1 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-91750 WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-91770 IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-reso... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-91772 Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thu... |
medium | 6.1 | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-91774 Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams... |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-85689 llmware 0.4.6 contains an SQL injection vulnerability in the collection-database... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-86114 Arcane versions before 2.0.0 fail to properly restrict template operations, allo... |
medium | 6.5 | — | — | 2026-09-05 | 2026-09-23 |
| CVE-2026-86115 Sim before 0.8.14 classifies tool requests as internal based on URL prefix match... |
medium | 5.0 | — | — | 2026-09-05 | 2026-09-23 |
| CVE-2026-86122 Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allo... |
medium | 5.0 | — | — | 2026-09-05 | 2026-09-23 |
| CVE-2026-89012 Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerab... |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-23 |
| CVE-2026-85177 CRMEB through 6.0.0 fails to validate message ownership in the edit_message hand... |
medium | 5.4 | — | — | 2026-09-03 | 2026-09-23 |
| CVE-2026-85605 Slink before 1.12.3 fails to properly authorize access to image comment endpoint... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-85665 Bruno versions through 4.1.0 fail to validate file paths in request body declara... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-85698 Turso through 0.8.0-pre.8 contains an out-of-bounds read vulnerability in the ta... |
medium | 5.5 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-85700 Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored i... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-86120 APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability... |
medium | 4.3 | — | — | 2026-09-05 | 2026-09-23 |
| CVE-2026-86178 Pixelfed through 0.12.9 fails to validate follower status in StoryComposeControl... |
medium | 5.4 | — | — | 2026-09-05 | 2026-09-23 |
| CVE-2026-91986 gitoxide gix-transport before 0.59.2 fails to filter control characters in git-d... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-85662 Marqo 2.26.0 contains a server-side request forgery vulnerability in the add_doc... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-85676 Dub contains an open redirect vulnerability in the redir_url query parameter tha... |
medium | 4.3 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-49439 OpenRemote is an open-source internet-of-things platform. |
medium | 4.3 | — | — | 2026-09-11 | 2026-09-23 |
| CVE-2026-90467 aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by c... |
medium | 4.0 | — | — | 2026-09-12 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.