September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-90516 A vulnerability was found in SourceCodester School Registration and Fee System 1... |
high | 7.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90523 A vulnerability was identified in jaychouchannel Tourism-Management-System up to... |
high | 7.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90526 A security vulnerability has been detected in SourceCodester School Registration... |
high | 7.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90566 A weakness has been identified in Rizwan17 inventory-management-system up to bfe... |
high | 7.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90579 A vulnerability has been found in cheshire-cat-ai Cheshire Cat AI up to 1.9.2. |
high | 7.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90618 A flaw has been found in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd11... |
high | 7.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90620 A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c... |
high | 7.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90689 A security flaw has been discovered in Tenda W20E 15.11.0.61068_1546_841_CN_TDC. |
high | 8.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90691 A security vulnerability has been detected in 0x4m4 HexStrike AI up to d689933ff... |
high | 8.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90701 A vulnerability was detected in subhajitkhan online-clinic-management-system up... |
high | 7.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90715 A security vulnerability has been detected in marcobambini Gravity up to 0.9.7. |
high | 7.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90787 A vulnerability was identified in Soarkey StudentManagement up to e08f7f1d5015af... |
high | 7.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90789 A weakness has been identified in itsourcecode Leave Management System 1.0. |
high | 7.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-86741 Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field bef... |
high | 8.5 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-14 |
| CVE-2026-86750 Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not validate company assignment a... |
high | 7.7 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-14 |
| CVE-2026-86538 knowns versions before 0.30.0 contain a path traversal vulnerability in the POST... |
high | 7.5 | — | — | 2026-09-07 | 2026-09-14 |
| CVE-2026-85612 OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery v... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-14 |
| CVE-2026-85625 sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the objec... |
high | 8.1 | — | — | 2026-09-04 | 2026-09-14 |
| CVE-2026-85200 The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all... |
high | 7.5 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-73313 XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerabilit... |
high | 8.1 | — | Xenforo / xenforo | 2026-09-08 | 2026-09-14 |
| CVE-2026-84889 IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-09-10 | 2026-09-14 |
| CVE-2026-86093 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker... |
high | 7.5 | — | Ibm / db2 | 2026-09-10 | 2026-09-14 |
| CVE-2026-87958 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a deni... |
high | 8.1 | — | Ibm / db2 | 2026-09-10 | 2026-09-14 |
| CVE-2026-78132 strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribu... |
high | 7.5 | — | Strongswan / strongswan | 2026-09-11 | 2026-09-14 |
| CVE-2026-78133 libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeyi... |
high | 7.5 | — | Strongswan / strongswan | 2026-09-11 | 2026-09-14 |
| CVE-2026-78134 strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and... |
high | 7.1 | — | Strongswan / strongswan | 2026-09-11 | 2026-09-14 |
| CVE-2026-88048 Tesseract is an open source OCR engine. |
high | 7.1 | — | Tesseract-ocr / tesseract ocr | 2026-09-10 | 2026-09-14 |
| CVE-2026-88047 Tesseract is an open source OCR engine. |
high | 7.8 | — | Tesseract-ocr / tesseract ocr | 2026-09-10 | 2026-09-14 |
| CVE-2026-88017 rclone is a command-line program to sync files and directories to and from diffe... |
high | 7.3 | — | Rclone / rclone | 2026-09-10 | 2026-09-14 |
| CVE-2026-88009 Traefik is an open source HTTP reverse proxy and load balancer. |
high | 8.2 | — | Traefik / traefik | 2026-09-10 | 2026-09-14 |
| CVE-2026-88004 Traefik is an open source HTTP reverse proxy and load balancer. |
high | 7.4 | — | Traefik / traefik | 2026-09-10 | 2026-09-14 |
| CVE-2026-80354 Authorization bypass through User-Controlled key vulnerability in Apache Camel K... |
high | 8.1 | — | Apache / camel | 2026-09-10 | 2026-09-14 |
| CVE-2026-69379 Improper link resolution before file access ('link following') in Windows NTFS a... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-14 |
| CVE-2026-69599 Use after free in Windows Remote Desktop Services allows an authorized attacker... |
high | 7.5 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-14 |
| CVE-2026-68884 Heap-based buffer overflow in Windows Kernel allows an authorized attacker to el... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-14 |
| CVE-2026-69501 Untrusted pointer dereference in Windows Secure Kernel Mode allows an authorized... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-14 |
| CVE-2026-69536 Use after free in Windows Remote Desktop Services allows an authorized attacker... |
high | 7.1 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-14 |
| CVE-2026-87921 A vulnerability was identified in Rizwan17 inventory-management-system up to bfe... |
high | 7.3 | — | — | 2026-09-09 | 2026-09-14 |
| CVE-2026-77827 Maono Link 3.8.13 MaonoAiServices Windows service allows local privilege escalat... |
high | 7.1 | — | — | 2026-09-08 | 2026-09-14 |
| CVE-2026-15451 The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privile... |
high | 8.8 | — | — | 2026-09-12 | 2026-09-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.