September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-69764 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-20502 In vdec, there is a possible out of bounds write due to a missing bounds check. |
high | 8.4 | — | Mediatek / mt2718 firmware | 2026-09-07 | 2026-09-09 |
| CVE-2026-20501 In vdec, there is a possible out of bounds write due to a heap buffer overflow. |
high | 8.4 | — | Mediatek / mt2718 firmware | 2026-09-07 | 2026-09-09 |
| CVE-2026-19300 IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain se... |
high | 7.5 | — | Langflow / langflow | 2026-09-04 | 2026-09-08 |
| CVE-2026-19305 IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain se... |
high | 7.5 | — | Langflow / langflow | 2026-09-04 | 2026-09-08 |
| CVE-2026-19306 IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read a... |
high | 7.7 | — | Langflow / langflow | 2026-09-04 | 2026-09-08 |
| CVE-2026-81832 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.... |
high | 7.7 | — | Ibm / app connect enterprise | 2026-09-04 | 2026-09-08 |
| CVE-2026-61699 nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. |
high | 8.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-63464 nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. |
high | 7.7 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-52767 YesWiki is a wiki system written in PHP. |
high | 8.2 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-52769 YesWiki is a wiki system written in PHP. |
high | 8.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-52770 YesWiki is a wiki system written in PHP. |
high | 7.5 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-52771 YesWiki is a wiki system written in PHP. |
high | 8.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-52775 YesWiki is a wiki system written in PHP. |
high | 8.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-83595 AVideo contains a cross-site request forgery vulnerability in plugin/API/set.jso... |
high | 8.1 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84187 AVideo contains a missing authentication vulnerability in plugin/Live/on_publish... |
high | 8.2 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84201 appium-mcp-server through 0.1.61 fails to validate or normalize file paths in th... |
high | 7.1 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84202 ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files,... |
high | 8.8 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84203 Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user c... |
high | 8.1 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-8712 Wyoming before 1.10.2 contains a server-side request forgery vulnerability that... |
high | 8.3 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-45221 Konga before 2.1.0 contains a privilege escalation vulnerability that allows low... |
high | 7.8 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-71981 Cypht before 2.12.2 contains a PHP object injection vulnerability that allows au... |
high | 8.8 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84208 AVideo through version 29.0 contains an unauthenticated SQL injection vulnerabil... |
high | 7.5 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84476 WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-F... |
high | 7.5 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84478 WWBN AVideo contains a path traversal vulnerability in the API get_api_login_cod... |
high | 7.3 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84482 WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulner... |
high | 8.8 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84695 BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in... |
high | 8.7 | — | — | 2026-09-02 | 2026-09-08 |
| CVE-2026-85155 WWBN AVideo contains a SQL injection vulnerability in the sort column parameter... |
high | 7.5 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85160 AVideo through commit c91b5975d contains a cross-site request forgery and path t... |
high | 8.1 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85164 WWBN AVideo through commit c91b5975d contains a server-side request forgery vuln... |
high | 7.1 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85174 SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an ac... |
high | 8.8 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85175 SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in th... |
high | 8.8 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-71963 Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote c... |
high | 8.8 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85388 Worklenz through 3.0.0 fails to properly validate the sort-field query parameter... |
high | 8.1 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85609 Openpanel before 2.3.0 contains an unauthenticated full-read server-side request... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85613 OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unau... |
high | 8.2 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85614 OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery v... |
high | 8.6 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-86716 A vulnerability was determined in Cesanta mJS up to 1.26. |
high | 7.3 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-80112 PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 10... |
high | 7.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-80114 PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 10... |
high | 7.8 | — | — | 2026-09-04 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.