September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-20517 In geniezone, there is a possible escalation of privilege due to use after free. |
medium | 6.7 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-20518 In geniezone, there is a possible information disclosure due to a missing bounds... |
medium | 4.4 | — | — | 2026-09-07 | 2026-09-28 |
| CVE-2026-86239 A vulnerability was identified in liufee FeehiCMS up to 2.1.1. |
medium | 5.3 | — | — | 2026-09-07 | 2026-09-28 |
| CVE-2026-86240 A security flaw has been discovered in liufee FeehiCMS up to 2.1.1. |
medium | 4.7 | — | — | 2026-09-07 | 2026-09-28 |
| CVE-2026-20503 In Modem, there is a possible system crash due to a missing bounds check. |
medium | 5.3 | — | Mediatek / mt2716 firmware | 2026-09-07 | 2026-09-09 |
| CVE-2026-20504 In Modem, there is a possible system crash due to a missing bounds check. |
medium | 5.3 | — | Mediatek / mt2735 firmware | 2026-09-07 | 2026-09-09 |
| CVE-2026-20506 In Audio HAL, there is a possible escalation of privilege due to use after free. |
medium | 6.7 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-20507 In Audio HAL, there is a possible escalation of privilege due to use after free. |
medium | 6.7 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-20508 In Power HAL, there is a possible escalation of privilege due to type confusion. |
medium | 6.7 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-20509 In Power HAL, there is a possible out of bounds write due to a missing bounds ch... |
medium | 6.7 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-20510 In camera middleware, there is a possible escalation of privilege due to double... |
medium | 6.7 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-20511 In SurfaceFlinger, there is a possible memory corruption due to use after free. |
medium | 6.7 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-20512 In Audio HAL, there is a possible escalation of privilege due to improper input... |
medium | 6.7 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-20500 In Modem, there is a possible system crash due to improper input validation. |
medium | 5.5 | — | Mediatek / mt2716 firmware | 2026-09-07 | 2026-09-09 |
| CVE-2026-86237 A vulnerability was found in openagents-org openagents up to 0.8.19/0.9.3.post20... |
medium | 5.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86238 A vulnerability was determined in projectworlds Online Examination System 1.0. |
medium | 4.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86236 A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. |
medium | 6.3 | — | — | 2026-09-07 | 2026-09-11 |
| CVE-2026-86235 A flaw has been found in itsourcecode Sales and Inventory System 1.0. |
medium | 6.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86233 A security vulnerability has been detected in itsourcecode Sales and Inventory S... |
medium | 6.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86234 A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. |
medium | 6.3 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86232 A weakness has been identified in itsourcecode Sales and Inventory System 1.0. |
medium | 6.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86228 A security vulnerability has been detected in JeecgBoot up to 3.9.3. |
medium | 4.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-19634 PostgreSQL Anonymizer contains a SQL injection vulnerability in two import funct... |
medium | 6.4 | — | — | 2026-09-06 | 2026-09-09 |
| CVE-2026-83534 PostgreSQL Anonymizer contains a vulnerability in the anon.anonymize_database_pa... |
medium | 6.4 | — | — | 2026-09-06 | 2026-09-09 |
| CVE-2026-86217 A vulnerability was detected in code-projects Hotel and Tourism Reservation in P... |
medium | 5.3 | — | — | 2026-09-06 | 2026-09-11 |
| CVE-2026-86216 A security vulnerability has been detected in code-projects Hotel and Tourism Re... |
medium | 4.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86215 A vulnerability was identified in Mstfakts College-Management-System. |
medium | 4.3 | — | — | 2026-09-06 | 2026-09-09 |
| CVE-2026-86258 nbviewer through 1.0.1 contains a path traversal vulnerability in LocalFileHandl... |
medium | 5.9 | — | — | 2026-09-06 | 2026-09-10 |
| CVE-2026-86252 h3 versions before 1.15.9 fail to sanitize carriage return characters in EventSt... |
medium | 5.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86253 h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability... |
medium | 5.9 | — | — | 2026-09-06 | 2026-09-10 |
| CVE-2026-86254 wger versions through master contain an incomplete authorization bypass in wger/... |
medium | 6.8 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86255 wger before 2.5 fails to validate the maximum duration of routine date ranges, a... |
medium | 6.5 | — | — | 2026-09-06 | 2026-09-18 |
| CVE-2026-86256 wger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerabi... |
medium | 5.4 | — | — | 2026-09-06 | 2026-09-09 |
| CVE-2026-86257 wger before 2.6 fails to sanitize first_name and last_name fields in the gym mem... |
medium | 5.4 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86205 h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the red... |
medium | 5.4 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86212 A vulnerability has been found in Open5GS 2.7.7/2.8.0. |
medium | 4.3 | — | — | 2026-09-06 | 2026-09-11 |
| CVE-2026-86251 h3 versions before 1.15.9 contain a path traversal vulnerability in the serveSta... |
medium | 5.9 | — | — | 2026-09-06 | 2026-09-09 |
| CVE-2021-48007 PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MoveP... |
medium | 6.5 | — | — | 2026-09-06 | 2026-10-08 |
| CVE-2022-51008 PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing at... |
medium | 5.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2020-37277 PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability i... |
medium | 6.5 | — | — | 2026-09-06 | 2026-10-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.