September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-101266 A logic flaw in the checkout flow allows users to bypass validations performed d... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-95509 Strings optimized for Latin-1 displaying Latin-1 characters cause incorrect Stri... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-7395 Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-11796 Asset Suite allows unauthenticated users to access PropertiesReloadServlet, Cach... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-15390 Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-19547 Ghostscript for Windows is vulnerable to local privilege escalation through Post... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-96430 Exposed Dangerous Method or Function in the
/WebAgenda/SQLWin.do API endpoint of... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-96431 Unrestricted Upload of File with Dangerous Type in the
/WebAgenda/download/uploa... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-96440 Improper Limitation of a Pathname to a Restricted
Directory（Path Traversal） in... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-96428 SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-96429 SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API
endpoint of Flowring... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-101169 In affected versions of Octopus Server, an authenticated user with permissions t... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-97685 An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surve... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-100371 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-100392 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101912 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101913 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101910 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101911 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in... |
not reported | — | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101906 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101907 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101908 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101909 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101900 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101901 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101902 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101903 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101904 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101905 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101898 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-86102 An OS command injection vulnerability in the WatchGuard AP internal API service... |
not reported | — | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-87969 An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows... |
not reported | — | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-58463 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-28 | 2026-10-16 |
| CVE-2026-58464 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-28 | 2026-10-16 |
| CVE-2026-48100 Payy is an Ethereum L2 zk-rollup for privacy preserving and regulatory compliant... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101891 An improper access control vulnerability in an internal API service on WatchGuar... |
not reported | — | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-91154 Missing Authentication for Critical Function (CWE-306) in the product cache reva... |
not reported | — | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-96538 WarehousePG (WHPG) 7.x before 7.6.0-WHPG is affected by a missing authorization... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-73641 Dayforce ESS Excelity is vulnerable to Reflected XSS in multiple endpoints. |
not reported | — | — | — | 2026-09-28 | 2026-10-13 |
| CVE-2026-73642 Dayforce ESS Excelity is vulnerable to Path Traversal in file download functiona... |
not reported | — | — | — | 2026-09-28 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.