September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-93685 A flaw was found in the multicluster-observability-addon. |
medium | 5.4 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-93595 ArcadeDB before 26.9.1 contains an access control bypass vulnerability in the qu... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-93013 RAGFlow through 0.27.2 contains a path traversal vulnerability in the dev_insert... |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-21 |
| CVE-2026-92927 A vulnerability was found in SourceCodester Drug Recommendation System 1.0. |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-21 |
| CVE-2026-84450 libheif is a HEIF and AVIF file format decoder and encoder. |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-94148 A vulnerability was determined in ScadaBR up to 1.1. |
medium | 5.3 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94043 A vulnerability was determined in Free5GC up to 4.2.3. |
medium | 5.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94048 A vulnerability was detected in CodeAstro QR Code Attendance Management System 1... |
medium | 6.6 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94090 A security flaw has been discovered in JusticeRage Manalyze 1.0.0. |
medium | 6.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-83346 Vulnerability in the Oracle Fusion Middleware Control product of Oracle Fusion M... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83274 Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Ch... |
medium | 5.5 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-72964 Missing authentication for critical function in Windows Internet Connection Shar... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-21 |
| CVE-2026-72945 Use of uninitialized resource in Windows Task Scheduler allows an authorized att... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-21 |
| CVE-2026-93963 A security vulnerability has been detected in itsourcecode Leave Management Syst... |
medium | 6.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-91971 Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-ba... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-91981 Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the... |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-75892 In osmo-ggsn 1.14.0 an out of bounds write issue was found in the gtp_decode_pdp... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-92949 vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to access... |
medium | 4.0 | — | — | 2026-09-17 | 2026-09-21 |
| CVE-2026-76871 Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure v... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-81925 Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date for... |
medium | 6.1 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-21 |
| CVE-2026-18426 Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission c... |
medium | 6.5 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-21 |
| CVE-2026-81926 Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rend... |
medium | 6.1 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-21 |
| CVE-2026-85386 Concrete CMS before 9.5.4 did not sanitize XML and XSLT documents uploaded throu... |
medium | 6.1 | — | Concretecms / concrete cms | 2026-09-16 | 2026-09-21 |
| CVE-2026-87028 Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted... |
medium | 6.5 | — | Concretecms / concrete cms | 2026-09-16 | 2026-09-21 |
| CVE-2026-18120 Concrete CMS before 9.5.3 exposed a legacy Express entry search endpoint that re... |
medium | 5.9 | — | Concretecms / concrete cms | 2026-09-16 | 2026-09-21 |
| CVE-2026-18422 Concrete CMS before 9.5.3 did not enforce a destination-side authorization check... |
medium | 6.5 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-21 |
| CVE-2026-81924 Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in... |
medium | 6.5 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-21 |
| CVE-2026-18116 Concrete CMS 8.3.0 to 9.5.2 stored calendar event names without sanitization and... |
medium | 6.1 | — | Concretecms / concrete cms | 2026-09-14 | 2026-09-21 |
| CVE-2026-90828 A security flaw has been discovered in GNU Binutils 2.47. |
medium | 6.6 | — | Gnu / binutils | 2026-09-14 | 2026-09-21 |
| CVE-2026-81235 Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain a Missing Cr... |
medium | 4.9 | — | Dell / wyse management suite | 2026-09-15 | 2026-09-21 |
| CVE-2026-81237 Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Improper... |
medium | 6.5 | — | Dell / wyse management suite | 2026-09-15 | 2026-09-21 |
| CVE-2026-76104 Dell ObjectScale, versions prior to 4.4.0.0, contains an Incorrect Permission As... |
medium | 5.5 | — | Dell / objectscale | 2026-09-16 | 2026-09-21 |
| CVE-2026-71181 Dell Update Package Framework, versions prior to 26.07.03, contains an Improper... |
medium | 6.0 | — | Dell / update package framework | 2026-09-16 | 2026-09-21 |
| CVE-2026-71182 Dell Update Package Framework, versions prior to 26.07.03, contains an Improper... |
medium | 6.0 | — | Dell / update package framework | 2026-09-16 | 2026-09-21 |
| CVE-2026-86862 pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database'... |
medium | 6.5 | — | Pgadmin / pgadmin 4 | 2026-09-17 | 2026-09-21 |
| CVE-2026-86861 pgAdmin 4's File Manager save_file endpoint, which backs saving from the Query T... |
medium | 5.9 | — | Pgadmin / pgadmin 4 | 2026-09-17 | 2026-09-21 |
| CVE-2026-0177 In do_sss_aes_gcm_256_op of crypto-aes.c, there is a possible out-of-bounds read... |
medium | 4.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0179 In Bootloader, there is a possible permission bypass due to a missing permission... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0183 In CPM, there is a possible information disclosure due to a confused deputy. |
medium | 4.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0186 In ac_init_one_sswrp of init.c, there is a possible escalation of privilege due... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.