September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-89134 A certificate with no dNSName SAN but another SAN type present (e.g. |
critical | 9.1 | — | Wolfssl / wolfssl | 2026-09-27 | 2026-10-02 |
| CVE-2026-100741 Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's... |
critical | 9.8 | — | — | 2026-09-27 | 2026-09-29 |
| CVE-2026-100833 Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime p... |
critical | 9.6 | — | — | 2026-09-27 | 2026-10-09 |
| CVE-2026-100721 vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module... |
critical | 9.0 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100740 A vulnerability was detected in D-Link DIR-895L A1_102b07. |
critical | 9.9 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-82901 The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitr... |
critical | 9.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-85984 The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPres... |
critical | 9.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-97162 Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extens... |
critical | 9.8 | — | Lomart / up | 2026-09-26 | 2026-10-20 |
| CVE-2026-97163 Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP pl... |
critical | 9.8 | — | Lomart / up | 2026-09-26 | 2026-10-20 |
| CVE-2026-94130 Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gal... |
critical | 9.8 | — | Joomlaboat / youtube gallery | 2026-09-26 | 2026-10-15 |
| CVE-2026-100714 Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchalleng... |
critical | 9.1 | — | — | 2026-09-26 | 2026-09-26 |
| CVE-2026-100715 Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink foll... |
critical | 9.6 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100716 Froxlor is a server administration panel. |
critical | 9.9 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100717 froxlor is a server administration panel. |
critical | 9.9 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100706 kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Po... |
critical | 9.9 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-18143 The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitr... |
critical | 9.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-97063 X-SpringBoot through 6.0 returns login verification codes in HTTP responses from... |
critical | 9.1 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-97064 X-SpringBoot through 6.0 ships with a hardcoded static master login verification... |
critical | 9.1 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-67237 RabbitMQ is a messaging and streaming broker. |
critical | 9.3 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-20 |
| CVE-2026-92161 FriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Fac... |
critical | 9.8 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-62262 Piwigo is a full featured open source photo gallery application for the web. |
critical | 9.1 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-39353 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
critical | 9.1 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-42322 Piwigo is a full featured open source photo gallery application for the web. |
critical | 9.1 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-93641 An unauthenticated sender can forge a share notification that triggers stored XS... |
critical | 9.3 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-93642 An unauthenticated sender can forge a share notification that triggers stored XS... |
critical | 9.3 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-93643 When OnlyOffice/Document Editing is available, an unauthenticated remote attacke... |
critical | 9.8 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-93647 An unauthenticated calendar sender can place active markup in a COUNTER message'... |
critical | 9.3 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-100075 In the Linux kernel, the following vulnerability has been resolved:
RDMA/srpt:... |
critical | 9.8 | — | Linux / linux kernel | 2026-09-25 | 2026-10-19 |
| CVE-2026-92609 Session fixation in HTTP management authentication allows remote attackers to ga... |
critical | 9.8 | — | Apache / qpid broker-j | 2026-09-25 | 2026-10-05 |
| CVE-2026-93399 The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Referenc... |
critical | 9.1 | — | — | 2026-09-25 | 2026-09-26 |
| CVE-2026-89055 The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to autho... |
critical | 9.1 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-14281 The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Co... |
critical | 9.8 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-92288 Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.2... |
critical | 9.1 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-92289 Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE b... |
critical | 9.1 | — | — | 2026-09-25 | 2026-09-26 |
| CVE-2026-97230 IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which e... |
critical | 9.8 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-95699 Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant auth... |
critical | 9.6 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-93291 Omni C20 lacks proper certificate validation which could allow an attacker to pe... |
critical | 9.4 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-13249 An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability... |
critical | 9.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-61741 http4s-scala-xml provides `EntityDecoder[F, scala.xml.Elem]` instances that pars... |
critical | 9.3 | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-61732 Decepticon is an autonomous hacking agent for red teams. |
critical | 10.0 | — | — | 2026-09-24 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.