September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-97649 A flaw has been found in ningzichun student-management-system up to 98760f5711cf... |
medium | 4.7 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-97723 madpsy ka9q_ubersdr before 0.1.58 has a stored cross-site scripting (XSS) vulner... |
medium | 5.4 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-95811 Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.... |
medium | 6.5 | — | — | 2026-09-25 | 2026-09-26 |
| CVE-2026-97647 A security vulnerability has been detected in ningzichun student-management-syst... |
medium | 5.3 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-97636 Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-sc... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-97366 A security flaw has been discovered in jhen0409 react-native-debugger up to 0.14... |
medium | 6.3 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-97368 A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. |
medium | 6.3 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-88386 libsndfile 1.2.2 contains a misaligned memory access issue in psf_binheader_read... |
medium | 5.5 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-88387 LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::... |
medium | 5.5 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-87118 The Botslab G980H dash camera firmware contains an out of bounds write vulnerabi... |
medium | 5.7 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-84403 The Botslab G980H dash camera firmware does not require authenticated pairing or... |
medium | 6.2 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-82585 The Botslab G980H dash camera firmware transmits sensitive information over unen... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-82708 The Botslab G980H dash camera firmware contains a path traversal vulnerability i... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-82716 The Botslab G980H dash camera firmware includes sensitive configuration informat... |
medium | 4.6 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-79959 The Botslab G980H dash camera firmware contains a hard-coded root account passwo... |
medium | 6.8 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-75558 The Botslab G980H dash camera firmware uses a hard-coded cryptographic key and i... |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-97365 A vulnerability was determined in chonkie-inc littrs 0.6.1/0.6.2. |
medium | 6.3 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-97325 A security flaw has been discovered in YunaiV/zhijiantianya ruoyi-vue-pro up to... |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-93290 Omni C20 uses hard-coded credentials that could allow an attacker to monitor log... |
medium | 5.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-88761 The Botslab G980H dash camera firmware generates the default WiFi password using... |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-88956 The Botslab G980H dash camera firmware contains an authentication vulnerability... |
medium | 6.8 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-48540 Krayin CRM through 2.2.6 contains a stored client-side template injection vulner... |
medium | 5.4 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-48541 Krayin CRM through 2.2.6 contains a stored client-side template injection vulner... |
medium | 5.4 | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-48542 Krayin CRM through 2.2.6 contains a stored client-side template injection vulner... |
medium | 5.4 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-48543 Krayin CRM through 2.2.6 contains a stored client-side template injection vulner... |
medium | 5.4 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-97320 A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. |
medium | 6.3 | — | — | 2026-09-24 | 2026-10-29 |
| CVE-2026-97321 A vulnerability has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.... |
medium | 6.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97322 A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-97323 A vulnerability was determined in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.... |
medium | 6.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96747 The client-side field level encryption support in the MongoDB Python Driver can... |
medium | 5.0 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96748 PyMongo's connection string parsing decodes percent-encoded characters in the ho... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-85738 TREK is a collaborative travel planner. |
medium | 6.3 | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-77320 TREK is a collaborative travel planner. |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-77321 TREK is a collaborative travel planner. |
medium | 4.3 | — | — | 2026-09-24 | 2026-10-05 |
| CVE-2026-62286 Dozzle is a realtime log viewer for docker containers. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-65827 Docmost is open-source collaborative wiki and documentation software. |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-52853 Docmost is open-source collaborative wiki and documentation software. |
medium | 5.2 | — | — | 2026-09-24 | 2026-10-05 |
| CVE-2026-56792 Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper... |
medium | 4.4 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-48072 Docmost is open-source collaborative wiki and documentation software. |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-48073 Docmost is open-source collaborative wiki and documentation software. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.