September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-94217 A flaw was found in the User-Managed Access (UMA) implementation of Keycloak. |
low | 3.5 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-94218 A flaw was found in the authentication session management of Keycloak, an identi... |
low | 3.1 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94145 A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. |
low | 3.5 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94137 A vulnerability was identified in Hangzhou Shunwang Technology shzh 10.7.2.693. |
low | 3.3 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-94045 A security flaw has been discovered in newbee-ltd newbee-mall up to 1.0.0. |
low | 3.5 | — | — | 2026-09-20 | 2026-09-24 |
| CVE-2026-94033 A vulnerability has been found in SourceCodester Drug Recommendation System 1.0. |
low | 3.5 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94034 A vulnerability was found in SourceCodester Drug Recommendation System 1.0. |
low | 3.5 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94030 A security vulnerability has been detected in SerenityOS up to 3d83e4509fd20d743... |
low | 3.1 | — | — | 2026-09-20 | 2026-09-24 |
| CVE-2026-94016 A security flaw has been discovered in SourceCodester Drug Recommendation System... |
low | 2.4 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-93977 A vulnerability was determined in code-projects Assessment Management 1.0. |
low | 3.5 | — | — | 2026-09-20 | 2026-09-24 |
| CVE-2026-93976 A vulnerability was found in code-projects Assessment Management 1.0. |
low | 2.4 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-93975 A vulnerability has been found in code-projects Assessment Management 1.0. |
low | 2.4 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-93968 A vulnerability was determined in aiyiyi121 SxDevOps 1.0/1.1. |
low | 3.8 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-92423 The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capabil... |
low | 2.7 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-92965 The TikTok WordPress plugin before 1.4.2 does not check that a request is author... |
low | 3.7 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-81651 The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not... |
low | 3.1 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-81652 The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not... |
low | 2.7 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-81654 The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not... |
low | 3.1 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-86551 The Z80Ultra (NX741J) product contains a vulnerability where non-privileged prog... |
low | 3.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-93956 A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. |
low | 3.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-93986 rclone before 1.75.1 fails to confine names from server and third-party listing... |
low | 3.1 | — | — | 2026-09-19 | 2026-09-22 |
| CVE-2026-93987 rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in... |
low | 3.4 | — | — | 2026-09-19 | 2026-09-22 |
| CVE-2026-93982 OpenPanel through 2.3.0 writes Model Context Protocol authentication tokens from... |
low | 3.3 | — | — | 2026-09-19 | 2026-10-02 |
| CVE-2026-92403 The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify... |
low | 3.7 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-92420 The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin b... |
low | 3.8 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2025-15698 The Business Name Generator WordPress plugin through 1.3 does not sanitise and e... |
low | 3.5 | — | — | 2026-09-19 | 2026-10-14 |
| CVE-2026-11545 IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to ob... |
low | 3.7 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93650 A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. |
low | 3.7 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-81178 SysReptor is a fully customizable pentest reporting platform. |
low | 3.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-81181 SysReptor is a fully customizable pentest reporting platform. |
low | 3.7 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-91142 A flaw was found in Cockpit. |
low | 3.6 | — | — | 2026-09-18 | 2026-10-16 |
| CVE-2026-85478 A CM2507 IP camera running firmware version HMT.CM2507 v251211.1507 exposes an i... |
low | 3.5 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-61633 NanoMQ is an MQTT broker. |
low | 2.0 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-44639 NanoMQ is an MQTT broker. |
low | 3.7 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-84400 CareCam CM2507 IP cameras contain an insufficiently protected network maintenanc... |
low | 3.1 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-84449 libheif is a HEIF and AVIF file format decoder and encoder. |
low | 3.7 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93676 xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configure... |
low | 3.2 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93505 A vulnerability was found in SveltyCMS 0.0.6. |
low | 3.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-16512 gptp_handle_msg() in subsys/net/l2/ethernet/gptp/gptp.c dereferenced the gPTP he... |
low | 3.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-93600 rustls-webpki (rustls/webpki) versions 0.101.0 through 0.103.11 and 0.104.0-alph... |
low | 2.2 | — | — | 2026-09-18 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.