September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,326
Critical
1,227
High
4,361
Medium
4,108
Low
460
Severity not reported
1,170
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-79920 Ajenti is a Linux & BSD modular server admin panel. |
critical | 9.9 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-58491 Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. |
critical | 9.3 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-93291 Omni C20 lacks proper certificate validation which could allow an attacker to pe... |
critical | 9.4 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-61550 Icinga 2 is an open source monitoring system. |
critical | 9.8 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-86124 AutoAgent contains an unauthenticated remote code execution vulnerability in the... |
critical | 9.8 | — | — | 2026-09-05 | 2026-09-24 |
| CVE-2026-91995 pig before 4.1.0 contains an authentication bypass vulnerability in the /registe... |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-89026 The Issabel Framework, the web framework supporting Issabel PBX software, before... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-92720 Kubero through 3.1.1 fails to apply authentication guards to the notifications A... |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92787 Feast through 0.66.0 fails to verify JWT token signatures before establishing us... |
critical | 9.8 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-47116 LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where the r... |
critical | 9.8 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-88624 Missing path validation in the Worktree.remove component of openCode v1.18.26 al... |
critical | 9.1 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-93352 Laravel-Mediable 7.0.0 before 7.0.2 contains an incomplete patch for CVE-2026-49... |
critical | 9.8 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-97360 HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access... |
critical | 10.0 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-39919 Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability i... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-28324 SolarWinds Observability Self-Hosted was found to be affected by an unauthentica... |
critical | 9.8 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-92716 Shuffle through 2.2.1 contains a cross-tenant privilege escalation vulnerability... |
critical | 9.6 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-85394 python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC ini... |
critical | 9.1 | — | — | 2026-09-03 | 2026-09-24 |
| CVE-2026-85688 TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vul... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-24 |
| CVE-2026-86121 Cua computer-server versions before 0.3.42 skip authentication when the CONTAINE... |
critical | 9.8 | — | — | 2026-09-05 | 2026-09-24 |
| CVE-2026-89259 Hugo is a static site generator. |
critical | 9.8 | — | — | 2026-09-11 | 2026-09-24 |
| CVE-2023-54398 Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability i... |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-13249 An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability... |
critical | 9.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-79787 Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in it... |
critical | 9.8 | — | — | 2026-08-25 | 2026-09-24 |
| CVE-2026-80154 All firmware versions of Lantronix SLC8000, SLC9000, EMG8500, EMG7500, SLB882, S... |
critical | 9.6 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-80155 Lantronix SLC8000 before firmware v9.7.0.5, SLC9000 before firmware v9.7.0.2, EM... |
critical | 10.0 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-80156 Lantronix SLC8000 before firmware v9.7.0.5, SLC9000 before firmware v9.7.0.2, EM... |
critical | 9.1 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-80143 Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmw... |
critical | 9.9 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-80147 Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmw... |
critical | 9.9 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-78312 Path Traversal in DIAEnergie. |
critical | 9.1 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-80144 Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmw... |
critical | 9.9 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-80145 Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmw... |
critical | 9.1 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-93425 Dokploy is a free, self-hostable Platform as a Service (PaaS). |
critical | 9.9 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-58822 In multiple functions of ftsmooth.c, there is a possible memory safety issue due... |
critical | 9.8 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-96891 A vulnerability was identified in D-Link DIR-825 3.00b32. |
critical | 9.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-75884 A flaw was found in AWX. |
critical | 9.1 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-18467 The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable... |
critical | 9.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-12227 The Visual Composer Website Builder plugin for WordPress is vulnerable to Local... |
critical | 9.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-93762 Mongoid contains an unsafe reflection weakness in the query path used for embedd... |
critical | 9.8 | — | Mongodb / mongoid | 2026-09-18 | 2026-09-24 |
| CVE-2026-49921 In multiple locations, there is a possible memory safety issue due to a heap buf... |
critical | 9.8 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-59167 SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript wit... |
critical | 10.0 | — | — | 2026-09-23 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.