September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-78626 The Okta Access Gateway improperly handles input sanitization and regular expres... |
medium | 6.5 | — | Okta / access gateway | 2026-09-08 | 2026-09-22 |
| CVE-2026-78627 The Okta Hyperdrive Integration installer does not mask the OAuth client secret... |
medium | 5.5 | — | Okta / hyperdrive | 2026-09-08 | 2026-09-22 |
| CVE-2026-78629 The Okta Hyperdrive agent plugin returns a success response without a signed SAM... |
medium | 5.5 | — | Okta / hyperdrive | 2026-09-08 | 2026-09-22 |
| CVE-2026-78630 The Okta Access Gateway does not neutralize shell metacharacters in SNMP configu... |
medium | 6.7 | — | Okta / access gateway | 2026-09-08 | 2026-09-22 |
| CVE-2026-78631 The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local ap... |
medium | 5.5 | — | Okta / hyperdrive | 2026-09-08 | 2026-09-22 |
| CVE-2022-26962 Italtel NFV 11.1.2-20210318 allows Multiple Stored XSS under NP_BCCAS-RMCTRL-01/... |
medium | 5.4 | — | — | 2026-09-10 | 2026-09-22 |
| CVE-2026-36392 FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting (XSS). |
medium | 5.4 | — | — | 2026-09-10 | 2026-09-22 |
| CVE-2026-71642 An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e... |
medium | 4.0 | — | — | 2026-09-10 | 2026-09-22 |
| CVE-2026-79590 A NULL pointer dereference vulnerability exists in the Prism parser component of... |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-22 |
| CVE-2026-79035 A reflected cross-site scripting (XSS) vulnerability in the p.rfihub.com compone... |
medium | 6.1 | — | — | 2026-09-11 | 2026-09-22 |
| CVE-2026-90679 Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a... |
medium | 4.3 | — | — | 2026-09-13 | 2026-09-22 |
| CVE-2026-36989 A SQL Injection vulnerability exists in LuxSoft LuxCal through 5.3.4L via rssfee... |
medium | 5.8 | — | — | 2026-09-13 | 2026-09-22 |
| CVE-2023-34854 HotelDruid before 3.0.6 has insufficient file upload sanitation in the backup/re... |
medium | 6.6 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-40772 A directory Traversal vulnerability in DataEase before 1.18.10 allows a remote a... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-45023 The femanager extension 7 before 7.2.2 for TYPO3 has Incorrect Access Control: i... |
medium | 4.2 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-46035 The svg_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrust... |
medium | 5.9 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-50459 An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-50460 An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-50462 An issue was discovered in the content_consent (aka Content Consent) extension t... |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-88618 1024-lab SmartAdmin v3.30.0 contains a stored cross-site scripting vulnerability... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-88620 SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorizat... |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-39038 BharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting (... |
medium | 6.1 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-39039 In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authen... |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-39040 BharatMLStack up to and including 1.3.0 is vulnerable to Cross Site Scripting (X... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-79409 An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive in... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-51133 Cross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance... |
medium | 6.1 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-88742 Bacularis 1.0.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in th... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-88743 Bacularis 4.7.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in di... |
medium | 6.1 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-88593 kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpo... |
medium | 6.1 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2021-3030 Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caus... |
medium | 6.1 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-79294 Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-36468 Cross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 allows remote unauth... |
medium | 6.1 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-36470 CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS) in index.php. |
medium | 5.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-36472 CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS). |
medium | 5.2 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-77165 File owners were unable to unlock TYPE_TOKEN locks placed by other users, leavin... |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-79318 web2py 3.2.2-stable (commit a7330a2bf21219fa77860b6665de927dd4f98e6d) is vulnera... |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-79317 A session invalidation flaw exists in x-ui 0.3.2. |
medium | 4.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-88403 A Server-Side Request Forgery (SSRF) in the serverRequest function of nocobase v... |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-88408 FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack ove... |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-88745 EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a... |
medium | 6.1 | — | — | 2026-09-21 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.