September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-90561 Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-... |
high | 8.7 | — | — | 2026-09-13 | 2026-09-24 |
| CVE-2026-91771 Weights & Biases wandb before 0.29.0 fails to validate the file name from server... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-92776 Wiki.js through 2.5.314 fails to require path separators when matching START and... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-95814 Vaultwarden through 1.37.3 omits organization membership status validation from... |
high | 8.1 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-79310 webpy web.py 0.76 is vulnerable to server-side template injection (SSTI). |
high | 8.5 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-91752 GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerabilit... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-89028 MikroTik RouterOS before 7.24 contains a heap memory corruption vulnerability in... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92718 Nuclei versions before 3.11.1 cache template signature verification based only o... |
high | 7.3 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92786 LightGBM through 4.7.0 fails to validate child and split array values when parsi... |
high | 7.8 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-75131 NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escala... |
high | 7.8 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-88372 libsndfile 1.2.2 contains an integer overflow vulnerability in mat4_read_header(... |
high | 7.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-92748 BC Security Empire before 6.7.1 fails to validate the multipart filename paramet... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92782 Chroma through 1.5.9 fails to validate tenant and database segments when resolvi... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-28325 SolarWinds Observability Self-Hosted was found to be affected by an unauthentica... |
high | 8.8 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-96808 In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper... |
high | 7.4 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-95521 A command injection flaw was found in rpm. |
high | 7.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96744 Improper neutralization of special elements in data query logic in the cache loc... |
high | 7.1 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-88382 hiredis commit 29ea279 (post-v1.5.0) contains an uncontrolled memory allocation... |
high | 7.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-93543 An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be... |
high | 7.4 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-75649 Bridge is affected by a Heap-based Buffer Overflow vulnerability that could resu... |
high | 7.8 | — | Adobe / bridge | 2026-09-22 | 2026-09-24 |
| CVE-2026-92469 zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vu... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92780 KnowStreaming through 3.4.1 fails to enforce role-based access control on REST A... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92785 Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo wit... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92788 Coze Studio through 0.5.1 fails to validate that table names in workflow SQL cus... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-88097 Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacke... |
high | 7.8 | — | Microsoft / edge chromium | 2026-09-18 | 2026-09-24 |
| CVE-2026-90776 Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vul... |
high | 7.5 | — | — | 2026-09-13 | 2026-09-24 |
| CVE-2026-91145 Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in p... |
high | 7.1 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-92719 Quickwit through 0.9.0 fails to validate the host and scheme of the queue_url pa... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92763 Rundeck through 6.2.1 fails to properly authorize the importConfig and importNod... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-94056 Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled pro... |
high | 7.5 | — | Exim / exim | 2026-09-19 | 2026-09-24 |
| CVE-2026-85620 Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where fun... |
high | 8.6 | — | — | 2026-09-04 | 2026-09-24 |
| CVE-2026-89147 Net-SNMP through 5.9.5.2 contains a denial of service vulnerability in the SMUX... |
high | 7.5 | — | — | 2026-09-11 | 2026-09-24 |
| CVE-2026-57842 NetBSD contains a use-after-free and double-free vulnerability in msg_recv_copyi... |
high | 7.0 | — | — | 2026-09-11 | 2026-09-24 |
| CVE-2026-90929 File Browser versions >= 2.5.0 and <= 2.63.23 contain an incorrect authorization... |
high | 8.1 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-82035 PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulne... |
high | 7.1 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-89025 Hirschmann HiOS Switch Platform devices contain a denial-of-service vulnerabilit... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-84700 PikiwiDB (Pika) v3.5.7 exposes an internal protobuf replication server on a port... |
high | 8.6 | — | — | 2026-09-02 | 2026-09-24 |
| CVE-2026-85179 Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticat... |
high | 8.5 | — | — | 2026-09-03 | 2026-09-24 |
| CVE-2026-85393 node-forge through 1.4.0 fails to validate element count in nested DigestAlgorit... |
high | 7.5 | — | — | 2026-09-03 | 2026-09-24 |
| CVE-2026-82520 parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbou... |
high | 7.5 | — | — | 2026-09-03 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.