September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-88007 Traefik is an open source HTTP reverse proxy and load balancer. |
critical | 9.1 | — | Traefik / traefik | 2026-09-10 | 2026-09-14 |
| CVE-2026-88008 Traefik is an open source HTTP reverse proxy and load balancer. |
critical | 9.1 | — | Traefik / traefik | 2026-09-10 | 2026-09-14 |
| CVE-2026-81800 Unauthenticated SQL Injection in Verified Reviews (Avis Vérifiés) <= 2.4.6 versi... |
critical | 9.3 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-88877 Traefik is a HTTP reverse proxy and load balancer. |
critical | 9.8 | — | Traefik / traefik | 2026-09-10 | 2026-10-08 |
| CVE-2026-88869 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored... |
critical | 9.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88864 Capgo (capgo.app) fails to restrict direct write access to the public.sso_provid... |
critical | 9.1 | — | — | 2026-09-10 | 2026-09-30 |
| CVE-2026-38626 Garlic-Hub v1.0.1 is vulnerable to SQL Injection in src/Modules/Items/Repositori... |
critical | 9.8 | — | — | 2026-09-10 | 2026-09-14 |
| CVE-2026-9163 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
critical | 9.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-8323 URL redirection to untrusted site ('open redirect') vulnerability in Armiya Info... |
critical | 9.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88285 GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service with... |
critical | 9.4 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88278 GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness... |
critical | 9.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-44950 fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies ea... |
critical | 9.0 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-59679 fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes t... |
critical | 9.0 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-80352 Improper Control of Generation of Code ('Code Injection') vulnerability in Apach... |
critical | 9.8 | — | Apache / camel | 2026-09-10 | 2026-09-14 |
| CVE-2026-80351 Improper neutralization of directives in dynamically evaluated code ('eval injec... |
critical | 9.8 | — | Apache / camel | 2026-09-10 | 2026-09-14 |
| CVE-2026-7188 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
critical | 9.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-78361 The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4... |
critical | 9.1 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-77770 The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugi... |
critical | 10.0 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-84939 Path traversal vulnerability in Apache FreeMarker template loading mechanism, if... |
critical | 9.1 | — | Apache / freemarker | 2026-09-10 | 2026-09-11 |
| CVE-2026-49364 An unauthenticated network-adjacent attacker can leverage discovery to capture c... |
critical | 9.1 | — | Apache / artemis | 2026-09-10 | 2026-09-16 |
| CVE-2026-57967 An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH pa... |
critical | 9.8 | — | Apache / artemis | 2026-09-10 | 2026-10-09 |
| CVE-2026-67593 A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause... |
critical | 9.1 | — | Apache / artemis | 2026-09-10 | 2026-09-16 |
| CVE-2026-19583 Velociraptor allows some sensitive artifacts to be gated by additional permissio... |
critical | 9.9 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-18351 The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulner... |
critical | 9.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-87931 A vulnerability has been found in Behavioral Technology Group Pavlok Behavioral... |
critical | 9.6 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-71805 An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.... |
critical | 9.8 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-71801 An issue was discovered in s-pms SPMS-Server through v1.0. |
critical | 9.8 | — | — | 2026-09-09 | 2026-09-14 |
| CVE-2026-36433 An issue in Actions Semiconductor Co. |
critical | 9.8 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-87911 An OS command injection weakness in the read-only enforcement of the SQL validat... |
critical | 9.6 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-54694 SkillTree is a micro-learning gamification platform. |
critical | 9.6 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-87929 MaxSite CMS through 109.6 ships with a hardcoded session encryption key in appli... |
critical | 9.8 | — | — | 2026-09-09 | 2026-09-14 |
| CVE-2026-79689 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
critical | 9.8 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-11 |
| CVE-2026-67401 A vulnerability in cPanel allows a mail-enabled account to achieve remote code e... |
critical | 9.9 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-22590 eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service)... |
critical | 9.1 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-79941 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
critical | 9.8 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-11 |
| CVE-2026-86751 Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note f... |
critical | 9.6 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-14 |
| CVE-2026-85102 Check Point Multiple Products Improper Certificate Validation Vulnerability |
critical | 9.8 | Listed | Check Point / Multiple Products | 2026-09-09 | 2026-09-23 |
| CVE-2026-85103 A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unau... |
critical | 9.8 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-80172 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
critical | 9.8 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-11 |
| CVE-2026-85978 An unauthenticated remote code execution vulnerability exists in the Policy Mana... |
critical | 9.8 | — | — | 2026-09-09 | 2026-09-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.