September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-57098 Improper verification of cryptographic signature in Windows RDP Client allows an... |
high | 7.5 | — | Microsoft / remote desktop client | 2026-09-08 | 2026-09-16 |
| CVE-2026-78450 Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unautho... |
high | 8.1 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-16 |
| CVE-2026-86771 Snipe-IT versions before 8.7.0 fail to HTML-escape the employee_num field in the... |
high | 7.6 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-86770 Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML au... |
high | 8.1 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-19885 OriginLab Origin Viewer OGWU File Parsing Out-Of-Bounds Write Remote Code Execut... |
high | 7.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-19886 OriginLab Origin Viewer OGM File Parsing Memory Corruption Remote Code Execution... |
high | 7.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-86762 Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the... |
high | 8.1 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-92176 pdfforge PDF Architect App Object Out-Of-Bounds Read Remote Code Execution Vulne... |
high | 7.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-92177 pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Executio... |
high | 7.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-92178 pdfforge PDF Architect PDF File Parsing Memory Corruption Remote Code Execution... |
high | 7.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-92179 pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Executio... |
high | 7.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-92180 pdfforge PDF Architect activation-service Update Service Uncontrolled Search Pat... |
high | 7.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-76853 Netcore NR268 firmware version 1.7.121109 contains a security check bypass vulne... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-92299 @jitsi/electron-sdk before 10.0.5 exposes getDesktopSources() via contextBridge... |
high | 7.4 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-45766 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-10 | 2026-09-16 |
| CVE-2026-45765 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-10 | 2026-09-16 |
| CVE-2026-92405 A security vulnerability has been detected in SourceCodester Inventory and Monit... |
high | 7.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-92215 A vulnerability has been found in a2ui-project a2ui up to 0.10.7. |
high | 7.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-92366 A vulnerability was determined in code-projects Matrimonial System 1.0. |
high | 7.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-86043 Skipper is an HTTP router and reverse proxy for service composition. |
high | 7.5 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-83368 Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition,... |
high | 7.0 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-45759 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-10 | 2026-09-16 |
| CVE-2026-76870 Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-76860 Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in wak... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-73459 On affected platforms running Arista EOS with IS-IS configured, an unauthenticat... |
high | 7.4 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-73446 On affected platforms running Arista EOS with IS-IS configured on a broadcast in... |
high | 7.4 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-91932 Flowise before 3.1.4 contains a validation bypass vulnerability in MCP server co... |
high | 8.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91934 Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Ch... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91943 Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PD... |
high | 7.7 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91973 Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV B... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91940 crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFConte... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91965 WWBN AVideo through 29.0 fails to enforce user-group restrictions in the plugin/... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91985 Vikunja before 2.6.0 fails to properly restrict access to the link-share hash fi... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91751 Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and new_id para... |
high | 8.3 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-89022 BookStack before 26.05.5 contains an authentication bypass vulnerability in its... |
high | 7.4 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-92466 zlt2000 microservices-platform through 6.0.0 contains a missing authorization vu... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-84511 An out-of-bounds write issue was addressed with improved bounds checking. |
high | 7.8 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-75092 A privilege escalation flaw was found in the scan_mysql actor of leapp-upgrade-e... |
high | 7.3 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-18212 A flaw was found in the SAML Redirect Binding implementation of Keycloak, an ope... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-79651 A flaw was found in the theme localization endpoints of the keycloak-services co... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.