September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87899 Execution with unnecessary privileges in cPanel allows remote authenticated user... |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-87900 Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remo... |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-82405 Klever-Go is the Go implementation of the Klever blockchain protocol. |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-82406 Klever-Go is the Go implementation of the Klever blockchain protocol. |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-82407 Klever-Go is the Go implementation of the Klever blockchain protocol. |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-82409 Klever-Go is the Go implementation of the Klever blockchain protocol. |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-67238 RabbitMQ is a messaging and streaming broker. |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-68490 Incorrect permission assignment allows local users to obtain sensitive CalDAV/Ca... |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-68492 An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 an... |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96770 All published s2s-proxy versions through 0.2.2 are affected. |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96872 Improper handling of insufficient permissions or privileges vulnerability in The... |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-94684 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-23 | 2026-10-01 |
| CVE-2026-93421 Mesop is a Python-based UI framework that allows users to build web applications... |
not reported | — | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-92692 Sulu is an open-source PHP content management system based on the Symfony framew... |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-92700 Caddy is an extensible server platform that uses TLS by default. |
not reported | — | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-92730 LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vu... |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-90900 Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefron... |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-90901 Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in M... |
not reported | — | — | — | 2026-09-23 | 2026-09-25 |
| CVE-2026-90902 Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in C... |
not reported | — | — | — | 2026-09-23 | 2026-09-25 |
| CVE-2026-90903 Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Admin... |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-90904 Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiCon... |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-90905 Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Conf... |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-92284 Caddy is an extensible server platform that uses TLS by default. |
not reported | — | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-90899 Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Gue... |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-82368 Insecure access controls on internal service ports in Brocade SANnav versions be... |
not reported | — | — | — | 2026-09-23 | 2026-10-01 |
| CVE-2026-77285 OpenBao is an open source identity-based secrets management system. |
not reported | — | — | — | 2026-09-23 | 2026-09-29 |
| CVE-2026-63131 OpenBao is an open source identity-based secrets management system. |
not reported | — | — | — | 2026-09-23 | 2026-09-29 |
| CVE-2026-63132 OpenBao is an open source identity-based secrets management system. |
not reported | — | — | — | 2026-09-23 | 2026-09-29 |
| CVE-2026-55456 Rejected reason: This CVE is a duplicate of another CVE. |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-52744 GoCD is a continuous deliver server. |
not reported | — | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-91775 LimeSurvey Community Edition 7.0.14 fails to safely encode attacker-controlled c... |
not reported | — | — | — | 2026-09-23 | 2026-10-02 |
| CVE-2026-18944 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93769 HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability t... |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-96609 Robur Albatross 1.0.0 through 2.x before 2.7.2 does not limit use of the ring bu... |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-92419 WEBCON BPS is vulnerable to Insecure Direct Object Reference (IDOR) in the /api/... |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-96559 Rejected reason: This ID was for testing |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-12974 A Security Policy Bypass vulnerability exists in Forcepoint Security Engine (NGF... |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-78253 Uncontrolled recursion in QXmlStreamReader::readElementText() in Qt Group Qt all... |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-5695 Arbitrary file upload vulnerability due to a lack of proper validation in upload... |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-5696 Reflected Cross-Site Scripting (XSS) in Microweber. |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.