September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-12351 IBM MQ 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-11921 IBM Verify Identity Access containers may not apply management password change o... |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-89026 The Issabel Framework, the web framework supporting Issabel PBX software, before... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-53710 MCP Context Forge is an AI gateway, registry, and proxy for MCP, A2A, REST, and... |
critical | 10.0 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2024-58385 Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fil... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-28 |
| CVE-2023-54398 Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability i... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-91949 FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vuln... |
critical | 9.3 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-55211 Surfio is a library for reading and writing surface files. |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-37152 TOTOLINK X5000R V9.1.0cu.2415_B20250515 was discovered to contain a hardcoded pa... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-88617 SmartAdmin v3.30.0 contains an authorization flaw in the configuration query end... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-79303 kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection. |
critical | 9.9 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-63695 Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Session F... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-63696 Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Download... |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-59971 MySQL MCP Server is a Model Context Protocol server that enables secure interact... |
critical | 10.0 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55158 Conflibot warns in advance when merging a pull request will cause conflicts in o... |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-29 |
| CVE-2026-39919 Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability i... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-92075 Mitigation bypass in the Networking component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92079 Mitigation bypass in the Widget: Win32 component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92066 Sandbox escape in the Profile Backup component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92071 Sandbox escape due to incorrect boundary conditions in the Widget: Win32 compone... |
critical | 9.6 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92057 Mitigation bypass in the Enterprise Policies component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92059 Incorrect boundary conditions in the DOM: Editor component. |
critical | 9.3 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92061 Incorrect boundary conditions in the Security: Process Sandboxing component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92048 Sandbox escape due to incorrect boundary conditions in the Widget: Win32 compone... |
critical | 9.0 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92050 Sandbox escape due to race condition in the XPConnect component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92051 Spoofing issue due to invalid pointer in the Graphics component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92037 Incorrect boundary conditions in the DOM: Animation component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92038 Mitigation bypass in the Remote Settings Client component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92041 Mitigation bypass in the DOM: Networking component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92045 Sandbox escape due to incorrect boundary conditions in the WebRTC component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92032 Sandbox escape due to invalid pointer in the Graphics component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92034 Site isolation issue in the Graphics component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92035 Sandbox escape due to incorrect boundary conditions in the Graphics component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92036 Incorrect boundary conditions in the Networking: HTTP component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92018 Sandbox escape in the DOM: Core & HTML component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-91998 Casdoor through 4.4.0 contains an authorization bypass vulnerability in the /api... |
critical | 9.9 | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-91995 pig before 4.1.0 contains an authentication bypass vulnerability in the /registe... |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-57138 PraisonAI is a multi-agent teams system. |
critical | 9.9 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-57139 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-57140 PraisonAI is a multi-agent teams system. |
critical | 9.4 | — | — | 2026-09-15 | 2026-09-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.