September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-90774 rustypaste before 0.18.1 validates the destination path before applying the opti... |
high | 7.5 | — | — | 2026-09-13 | 2026-09-23 |
| CVE-2026-90778 SIPp through 3.7.7 contains a buffer overflow vulnerability in get_peer_tag() fu... |
high | 7.5 | — | — | 2026-09-13 | 2026-09-23 |
| CVE-2026-82028 Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-91143 goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT t... |
high | 7.2 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-91200 DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry n... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-91929 Flowise versions before 3.1.4 contain cross-tenant authorization gaps in Enterpr... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-91930 Flowise before 3.1.4 fails to scope enterprise organization and workspace member... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-91931 Flowise before 3.1.4 contains a remote code execution vulnerability in the Custo... |
high | 8.5 | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-91937 Flowise before 3.1.4 fails to sanitize the overrideConfig.sessionId parameter be... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-76834 b2evolution CMS versions 6.7.8 through 7.2.5 contain an incomplete fix for CVE-2... |
high | 8.1 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-84702 facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name... |
high | 7.5 | — | — | 2026-09-02 | 2026-09-23 |
| CVE-2026-85671 QAnything 2.0.0 contains an authentication bypass vulnerability in the /api/loca... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-85685 AgentScope through 2.0.7.post1 contains a path traversal vulnerability in LocalW... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-85686 ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-85690 Plandex 2.2.1 contains a path traversal vulnerability in the ApplyFiles function... |
high | 7.8 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-85691 MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnera... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-86090 ntopng before 6.7.260717 fails to perform authorization checks in the delete end... |
high | 7.1 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-86091 ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete... |
high | 7.1 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-86098 ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in th... |
high | 7.4 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-86169 Axolotl before 0.19.0 contains a remote code execution vulnerability in the mult... |
high | 8.8 | — | — | 2026-09-05 | 2026-09-23 |
| CVE-2026-89011 isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the... |
high | 7.1 | — | — | 2026-09-10 | 2026-09-23 |
| CVE-2026-89013 Dolibarr 23.0.4 before 24.0.1 contains an authorization bypass vulnerability tha... |
high | 7.5 | — | — | 2026-09-11 | 2026-09-23 |
| CVE-2026-85395 UnoPim before 2.1.3 fails to include integration store, update, and key-generati... |
high | 7.1 | — | — | 2026-09-03 | 2026-09-23 |
| CVE-2026-82527 R2R through 3.6.6 contains a SQL injection vulnerability that allows unauthentic... |
high | 7.5 | — | — | 2026-09-03 | 2026-09-23 |
| CVE-2026-85606 firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-85626 git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref an... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-85666 OGX (formerly Llama Stack, affected at commit fbe8e0f) contains an unauthenticat... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-9317 Nango before 0.71.6 contains a missing authentication vulnerability in the runne... |
high | 8.1 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-86173 MindsDB through 26.1.0 contains a server-side request forgery vulnerability in t... |
high | 7.5 | — | — | 2026-09-05 | 2026-09-23 |
| CVE-2026-86185 Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wi... |
high | 8.0 | — | — | 2026-09-05 | 2026-09-23 |
| CVE-2026-10144 Rsbuild before 2.0.9 contains a command injection vulnerability that allows atta... |
high | 7.8 | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-90556 Freeciv versions before 3.2.6 contain a heap buffer overflow in worklist_load()... |
high | 7.8 | — | — | 2026-09-12 | 2026-09-23 |
| CVE-2026-90770 Spug through 3.4.0 contains a remote code execution vulnerability in the ping_ch... |
high | 8.8 | — | — | 2026-09-13 | 2026-09-23 |
| CVE-2026-90777 ESPnet before 202609 deserializes pretrained model checkpoints using torch.load... |
high | 8.8 | — | — | 2026-09-13 | 2026-09-23 |
| CVE-2026-90779 SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthH... |
high | 7.5 | — | — | 2026-09-13 | 2026-09-23 |
| CVE-2026-90780 SIPp through 3.7.7 contains a buffer overflow vulnerability in the get_header()... |
high | 7.5 | — | — | 2026-09-13 | 2026-09-23 |
| CVE-2026-90933 laradashboard through 1.2.2 contains a missing authorization vulnerability in th... |
high | 7.1 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-90938 LangBot's plugin runtime (pip package langbot_plugin) through 0.4.17 starts a de... |
high | 8.6 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-90946 DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerabili... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-91080 webhook through 2.8.3 reads the entire request body into memory before evaluatin... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.