September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,182
Critical
1,210
High
4,307
Medium
4,068
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84657 In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command doe... |
medium | 4.2 | — | Jenkins / jenkins | 2026-09-02 | 2026-09-15 |
| CVE-2026-84538 A denial-of-service issue was addressed with improved input validation. |
medium | 6.5 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
| CVE-2026-86876 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 5.2 | — | Apple / ipados | 2026-09-14 | 2026-09-15 |
| CVE-2026-86879 A denial-of-service issue was addressed with improved input validation. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-15 |
| CVE-2026-87511 Missing authorization in DevTools in Google Chrome prior to 153.0.8010.36 allowe... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-15 |
| CVE-2026-87473 Incorrect authorization in FileHandling in Google Chrome prior to 153.0.8010.36... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-15 |
| CVE-2026-87469 Improper input validation in Extensions in Google Chrome prior to 153.0.8010.36... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-15 |
| CVE-2026-89263 MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEma... |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-15 |
| CVE-2026-89252 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify o... |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-15 |
| CVE-2026-89257 AVideo through 29.0 contains an insecure direct object reference (IDOR) vulnerab... |
medium | 5.4 | — | — | 2026-09-11 | 2026-09-15 |
| CVE-2026-89247 WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier conta... |
medium | 6.1 | — | — | 2026-09-11 | 2026-09-15 |
| CVE-2026-9225 IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated atta... |
medium | 6.5 | — | Langflow / langflow | 2026-09-10 | 2026-09-15 |
| CVE-2026-9667 IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side reque... |
medium | 5.3 | — | Ibm / websphere application server | 2026-09-10 | 2026-09-15 |
| CVE-2026-79513 A divide-by-zero vulnerability in the gf_dash_get_timeline_duration function (sr... |
medium | 6.5 | — | Gpac / gpac | 2026-09-09 | 2026-09-15 |
| CVE-2026-79514 An out-of-bounds read in the gf_dm_data_received function (downloader.c) of GPAC... |
medium | 6.5 | — | Gpac / gpac | 2026-09-09 | 2026-09-15 |
| CVE-2026-79522 An out-of-bounds read in the gf_dm_get_chunk_data function (src/utils/downloader... |
medium | 6.5 | — | Gpac / gpac | 2026-09-09 | 2026-09-15 |
| CVE-2026-87012 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
medium | 4.3 | — | Openwebui / open webui | 2026-09-09 | 2026-09-15 |
| CVE-2026-90786 A vulnerability was determined in Dvidelabs flatcc up to 0.6.3. |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90698 A security flaw has been discovered in memcached 1.6.41/1.6.42/1.6.43. |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90688 A vulnerability was identified in Tenda W20E 15.11.0.61068_1546_841_CN_TDC. |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-78123 strongSwan 5.0.2 through 6.0.7 has an Expired Pointer Dereference in PKCS#7 pars... |
medium | 5.9 | — | Strongswan / strongswan | 2026-09-11 | 2026-09-15 |
| CVE-2026-73029 Buffer over-read in SQL Server allows an authorized attacker to disclose informa... |
medium | 6.5 | — | Microsoft / sql server 2019 | 2026-09-08 | 2026-09-15 |
| CVE-2026-87013 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
medium | 4.3 | — | Openwebui / open webui | 2026-09-09 | 2026-09-15 |
| CVE-2026-87014 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
medium | 6.5 | — | Openwebui / open webui | 2026-09-09 | 2026-09-15 |
| CVE-2026-87015 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
medium | 6.8 | — | Openwebui / open webui | 2026-09-09 | 2026-09-15 |
| CVE-2026-91086 A security vulnerability has been detected in GPAC up to f1219cde. |
medium | 6.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-91088 A vulnerability has been found in GPAC up to f1219cde. |
medium | 4.8 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-91091 A vulnerability was identified in GPAC up to f1219cde. |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90791 A vulnerability was detected in GPAC up to f1219cde. |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90796 A vulnerability was identified in itsourcecode Leave Management System 1.0. |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90810 A security flaw has been discovered in cosmicstack-labs mercury-agent up to 1.1.... |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90815 A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90519 A weakness has been identified in PHPGurukul Bank Locker Management System 1.0. |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90572 A vulnerability was determined in davenardella snap7 up to 1.4.3. |
medium | 4.7 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90577 A vulnerability was detected in GPAC up to f1219cde. |
medium | 5.3 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90582 A vulnerability was identified in evanchiu serverless-todo 1.0.3/2.0.0. |
medium | 5.3 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90488 A vulnerability was determined in Xuxueli xxl-job up to 3.4.2. |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-88896 EspoCRM before 10.0.4 is vulnerable to server-side request forgery. |
medium | 5.3 | — | — | 2026-09-10 | 2026-09-15 |
| CVE-2026-88897 Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials throug... |
medium | 5.9 | — | — | 2026-09-10 | 2026-09-15 |
| CVE-2026-89045 zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length para... |
medium | 4.0 | — | — | 2026-09-10 | 2026-09-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.