September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92816 ComfyUI before 0.30.0 fails to sanitize folder_name input in dataset save nodes,... |
high | 7.8 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92918 admin3 through 3.0.0 persists user session tokens in the audit log event body wh... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92919 admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload h... |
high | 8.1 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92970 HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project fi... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92971 InternLM LMDeploy through 0.17.0 contains a reachable assertion vulnerability in... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92983 InternLM LMDeploy through 0.17.0 in DistServe prefill/decode disaggregation mode... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92984 HUBzero CMS through 2.2.32 accepts session identifiers from query strings and re... |
high | 8.1 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92980 HortusFox-Web prior to version 6.1 contains a remote code execution vulnerabilit... |
high | 7.2 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-93456 django-page-cms through 2.0.13 exempts five admin mutation views from CSRF prote... |
high | 8.2 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-77929 ClipBucket v5 before 5.5.3-#182 contains a file upload vulnerability that allows... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93657 hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof sta... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93868 Cotonti through 1.0.0 derives password recovery validation tokens from md5(micro... |
high | 8.1 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93872 Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize() without al... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-94534 lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInf... |
high | 7.1 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94535 lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the... |
high | 7.1 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-63104 Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerabilit... |
high | 8.1 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-73753 Exploitation through affected command-line operations could allow an authenticat... |
high | 8.8 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-22 |
| CVE-2026-73780 A vulnerability in the web-based management interface of AOS-CX switches exposes... |
high | 8.3 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-22 |
| CVE-2026-92794 OpenSign through 2.41.3 fails to validate caller identity in the getDocument clo... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92804 Nango through 0.70.4 fails to validate caller-supplied connection configuration... |
high | 7.1 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92806 phpList versions before 3.6.17 fail to validate cross-site request forgery token... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92577 In AVideo through 29.0, the API get_api_video endpoint contains a broken access... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92578 WWBN AVideo through 29.0 contains an authentication bypass vulnerability where t... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92580 In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92582 AVideo (WWBN/AVideo) through 29.0 (commit e01e41ecc) is vulnerable to cross-site... |
high | 7.1 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92913 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptograp... |
high | 7.4 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92914 AVideo LoginControl contains an authentication bypass vulnerability in the PGP s... |
high | 8.1 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92915 WWBN AVideo through commit e01e41ecc (no patched version available) contains a b... |
high | 7.3 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92972 SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthen... |
high | 8.6 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92987 roxmltree through 0.21.1 performs quadratic-time attribute and namespace validat... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-93014 RosarioSIS versions before 12.9 fail to validate the filename request parameter... |
high | 7.1 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-93453 SOGo before 5.12.11 constructs password-reset links using the client-supplied Or... |
high | 8.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-81942 PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions bef... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-81944 PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions bef... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93688 SGLang through 0.5.19 in prefill/decode disaggregation mode with Mooncake KV tra... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2019-25776 Weaver E-cology contains an unauthenticated SQL injection vulnerability that all... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93992 Gopeed through 2.0.0-beta.3 contains a path traversal vulnerability in archive e... |
high | 8.1 | — | — | 2026-09-19 | 2026-09-22 |
| CVE-2026-93993 Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the... |
high | 8.8 | — | — | 2026-09-19 | 2026-09-22 |
| CVE-2026-94107 NivoCart through 2.4.0 contains a predictable password reset token vulnerability... |
high | 8.1 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-94412 jshERP through 3.6 contains an authorization bypass vulnerability in the POST /u... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.