September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-103442 External control of system or configuration setting vulnerability in The Wikimed... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103470 In Internet2 Grouper before 7.5.1 (in some configurations), a user who is allowe... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103441 Deserialization of untrusted data vulnerability in The Wikimedia Foundation Medi... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94545 Satori is a library to convert HTML and CSS to SVG. |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97259 Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103388 MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whene... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103389 MISP contains a stored cross-site scripting (XSS) vulnerability in the galaxy ic... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102984 Astro is a web framework for content-driven websites. |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102983 Astro is a web framework for content-driven websites. |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-93903 LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect UR... |
not reported | — | — | — | 2026-09-30 | 2026-10-29 |
| CVE-2026-91860 A prototype pollution vulnerability exists in the deep merge helpers of Vaadin C... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-93547 A missing authorization check in the Vaadin Spreadsheet component allows an auth... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-74865 sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-74864 sogo_yhn configures SOGo with a parameter that forces the request with HTTP head... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103321 MISP contains a stored cross-site script (XSS) vulnerability in the event graph... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103012 Claude Code selected an API key stored by Claude Code, for example from an earli... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-10726 Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclos... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-10739 Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96342 Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103239 MISP contains a privilege escalation vulnerability in the tag collection creatio... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103235 MISP contains a mass assignment vulnerability in the event delegation feature. |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103237 MISP contains an improper input validation vulnerability in its ORM save path. |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102509 Memory Allocation with Excessive Size Value, Allocation of Resources Without Lim... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102510 Integer Overflow, Improper Validation of Array Index, Uncontrolled Recursion and... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102511 Improper Verification of Source of a Communication Channel in the ADS discovery... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102508 Improper Verification of Cryptographic Signature and Improper Certificate Valida... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103087 Uncontrolled recursion in the Gosub browser engine (gosub-engine) through 0.1.0... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-51936 Zetetic SQLCipher before 4.15.0 allows SQL injection. |
not reported | — | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-81433 A stack-based buffer overflow vulnerability in WatchGuard Fireware OS's DHCP fin... |
not reported | — | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-15278 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-29 | 2026-10-16 |
| CVE-2026-93853 Unverified ownership in Barman snapshot backup deletion allows a principal who c... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102938 virtualenv is a tool for creating isolated virtual python environments. |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102930 virtualenv is a tool for creating isolated virtual python environments. |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102937 virtualenv is a tool for creating isolated virtual python environments. |
not reported | — | — | — | 2026-09-29 | 2026-10-02 |
| CVE-2026-11415 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-29 | 2026-10-16 |
| CVE-2026-102252 A path traversal vulnerability (CWE-22) in the embedded VMDK filesystem extracto... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102829 simple-git, an interface for running git commands in any node.js application, en... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-12345 The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. |
not reported | — | — | — | 2026-09-29 | 2026-10-26 |
| CVE-2026-102759 NetX Secure TLS accepts an empty application-data record without verifying its m... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102760 When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on a... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.