September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-97248 Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions. |
critical | 9.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96822 Unauthenticated SQL Injection in Books Gallery <= 4.8.3 versions. |
critical | 9.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96350 Subscriber Privilege Escalation in Estatik <= 4.3.5 versions. |
critical | 9.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96349 Unauthenticated Remote Code Execution (RCE) in SiteSkite <= 2.1.8 versions. |
critical | 10.0 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94389 Unauthenticated Remote Code Execution (RCE) in AcyMailing SMTP Newsletter <= 11.... |
critical | 9.0 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-89238 WSS4J EncryptedHeader child confusion could promote an attacker-controlled plain... |
critical | 9.1 | — | Apache / wss4j | 2026-09-30 | 2026-10-06 |
| CVE-2026-76504 Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability |
critical | 9.8 | Listed | Cisco / Catalyst SD-WAN Manager | 2026-09-30 | 2026-10-03 |
| CVE-2026-87830 In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupport... |
critical | 9.1 | — | Apache / wss4j | 2026-09-30 | 2026-10-06 |
| CVE-2026-88920 An authentication bypass in the DOM security processor in Apache WSS4J allows un... |
critical | 9.8 | — | Apache / wss4j | 2026-09-30 | 2026-10-02 |
| CVE-2026-94052 A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MI... |
critical | 9.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94053 Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA S... |
critical | 9.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-77185 Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0... |
critical | 9.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102455 EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. |
critical | 9.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102458 EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. |
critical | 9.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97196 Improper Validation of Unsafe Equivalence in Input vulnerability in Liquid Web /... |
critical | 9.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-75873 The Zella Theme WordPress theme before 2.6.3 does not perform any capability or... |
critical | 9.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103110 Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper in... |
critical | 9.8 | — | Pexip / pexip infinity | 2026-09-30 | 2026-10-05 |
| CVE-2026-102911 A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. |
critical | 9.9 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103109 Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper in... |
critical | 9.4 | — | Pexip / pexip infinity | 2026-09-30 | 2026-10-05 |
| CVE-2026-103056 AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in... |
critical | 9.0 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-86131 A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client... |
critical | 9.8 | — | Watchguard / fireware | 2026-09-30 | 2026-10-06 |
| CVE-2026-102794 A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. |
critical | 9.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102793 A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. |
critical | 9.1 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-103044 XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundat... |
critical | 9.8 | — | — | 2026-09-29 | 2026-10-01 |
| CVE-2026-102792 A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. |
critical | 9.1 | — | — | 2026-09-29 | 2026-10-02 |
| CVE-2026-103040 LightLLM through 1.2.0 contains a remote code execution vulnerability in the rou... |
critical | 9.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-103041 LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cac... |
critical | 9.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-72507 The "reportType" parameter in the product summary report feature within the bala... |
critical | 9.0 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-72510 The "supplier_no" parameter used in the business allocation search feature is vu... |
critical | 9.0 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-71379 The file export endpoint allows any unauthenticated attacker to export arbitrary... |
critical | 10.0 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-70356 The TMS file upload endpoint fails to enforce server-side file type restrictions... |
critical | 9.1 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-68954 The "pattern" parameter used in search function in the home page of the TMS appl... |
critical | 9.0 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-68068 The "screenID" parameter in the electronic transaction queue viewer feature with... |
critical | 9.0 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-63713 The "search" parameter in the view audit logs feature within the utilities secti... |
critical | 9.0 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-94952 A stack-based buffer overflow vulnerability exists in the web management interfa... |
critical | 9.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-96587 The Viidure Android application embeds permanent, plaintext cloud storage creden... |
critical | 10.0 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-79536 bytebase dbhub v1.2.0 was discovered to contain a SQL injection vulnerability in... |
critical | 9.1 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-79537 metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference... |
critical | 9.1 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-79538 metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution i... |
critical | 9.8 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-76721 Buffer overflow vulnerability exists in the affected interface of HPE Networking... |
critical | 9.8 | — | — | 2026-09-29 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.