September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,182
Critical
1,210
High
4,307
Medium
4,068
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-61910 An issue was discovered in Cyrus IMAP before 3.12.4. |
medium | 5.0 | — | Cyrus / imap | 2026-09-09 | 2026-09-16 |
| CVE-2026-61911 An issue was discovered in Cyrus IMAP before 3.12.4. |
medium | 4.3 | — | Cyrus / imap | 2026-09-09 | 2026-09-16 |
| CVE-2026-87017 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
medium | 4.3 | — | Openwebui / open webui | 2026-09-09 | 2026-09-16 |
| CVE-2026-90716 A vulnerability was detected in marcobambini Gravity up to 0.9.7. |
medium | 5.5 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90700 A security vulnerability has been detected in itsourcecode Sales and Inventory S... |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90705 A vulnerability was determined in D-Link DWR-M921 1.1.52. |
medium | 6.6 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90598 A vulnerability was detected in jaygajera17 E-commerce-project-springBoot up to... |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90580 A vulnerability was found in FlowiseAI Flowise up to 3.0.2. |
medium | 6.3 | — | Flowiseai / flowise | 2026-09-13 | 2026-09-16 |
| CVE-2026-90565 A security flaw has been discovered in Rizwan17 inventory-management-system up t... |
medium | 5.3 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90527 A vulnerability was detected in quequnlong shiyi-blog up to 1.2.1. |
medium | 4.3 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90517 A vulnerability was identified in PHPGurukul Bank Locker Management System 1.0. |
medium | 5.3 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2023-51769 Frappe before 14.49.0 allows an XSS attack that is associated with blog pages an... |
medium | 6.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-87994 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
medium | 4.3 | — | Openwebui / open webui | 2026-09-09 | 2026-09-16 |
| CVE-2026-87997 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
medium | 4.3 | — | Openwebui / open webui | 2026-09-09 | 2026-09-16 |
| CVE-2026-87818 GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff... |
medium | 6.5 | — | Gitpython Project / gitpython | 2026-09-09 | 2026-09-16 |
| CVE-2026-68842 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-16 |
| CVE-2026-65407 A use after free issue was addressed with improved memory management. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-65412 A null pointer dereference was addressed with improved input validation. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-65413 An integer overflow was addressed with improved input validation. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-84541 An input validation issue was addressed with improved input validation. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-90496 A vulnerability was found in Fengoffice Feng Office up to 3.11.13.11. |
medium | 4.7 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90501 A security vulnerability has been detected in lenve vhr 1.0-SNAPSHOT. |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90506 A vulnerability was determined in vvbbnn00 WARP-Clash-API up to c7bf236007395986... |
medium | 5.0 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90511 A vulnerability was detected in GongShengyue OnlineBooks up to dfc5eacc08d3b0396... |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-84534 A path handling issue was addressed with improved validation. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-18061 Improper restriction of XML external entity references in the RemoteQueryCachePl... |
medium | 5.9 | — | Amazon / advanced jdbc wrapper | 2026-09-11 | 2026-09-16 |
| CVE-2026-89332 Inclusion of functionality from an untrusted control sphere in the Kiro Powers f... |
medium | 5.5 | — | Amazon / kiro ide | 2026-09-11 | 2026-09-16 |
| CVE-2026-48987 pyLoad is a free and open-source download manager written in Python. |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91855 A security flaw has been discovered in Open5GS up to 2.7.7. |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-57128 PraisonAI is a multi-agent teams system. |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-91021 Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site script... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-54246 Skipper is an HTTP router and reverse proxy for service composition. |
medium | 5.7 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-76081 ZITADEL is an open source identity management platform. |
medium | 5.5 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-86118 gonic versions before 0.22.0 fail to validate administrator privileges in the st... |
medium | 4.3 | — | — | 2026-09-05 | 2026-09-16 |
| CVE-2026-29810 CyberPanel before 2.4.4 omits a "return 0" that is required by the business logi... |
medium | 4.3 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-29812 CyberPanel before 2.4.4 has no logging for actions that could potentially manipu... |
medium | 4.3 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-49837 GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go P... |
medium | 5.9 | — | — | 2026-09-10 | 2026-09-16 |
| CVE-2026-49838 GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go P... |
medium | 5.9 | — | — | 2026-09-10 | 2026-09-16 |
| CVE-2026-86174 Plane through 1.4.2 fails to validate that issues belong to the deploy board's p... |
medium | 4.3 | — | — | 2026-09-05 | 2026-09-16 |
| CVE-2026-84701 NocoBase fails to sanitize rich text field values in the read renderer, allowing... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.