September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-56792 Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper... |
medium | 4.4 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-48542 Krayin CRM through 2.2.6 contains a stored client-side template injection vulner... |
medium | 5.4 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-96678 A security vulnerability has been detected in weiqingwen spring-boot-forum up to... |
medium | 6.3 | — | — | 2026-09-23 | 2026-09-29 |
| CVE-2026-96763 A security flaw has been discovered in kvcache-ai mooncake up to 0.3.12/0.3.13.p... |
medium | 5.4 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-96777 A vulnerability was determined in Forma LMS up to 4.1.43. |
medium | 6.3 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-96882 A vulnerability was identified in TaleLin lin-cms-spring-boot up to 0.2.1. |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-97061 Black Candy through 3.2.1 fails to scope playlist search queries to the authenti... |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-91132 Discourse is an open-source discussion platform. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-91134 Discourse is an open-source discussion platform. |
medium | 5.4 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-88387 LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::... |
medium | 5.5 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-88377 Bento4 1.6.0.0 contains an integer underflow vulnerability in the avcC and hvcC... |
medium | 6.2 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-88358 simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::pars... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-79759 Termix is a web-based server management platform with SSH terminal, tunneling, a... |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-57176 Python Social Auth is a social authentication/registration mechanism. |
medium | 6.8 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-96672 Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Te... |
medium | 6.4 | — | — | 2026-09-23 | 2026-09-29 |
| CVE-2026-92164 Streamlink is a CLI utility which pipes video streams from various services into... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-29 |
| CVE-2026-84852 A security vulnerability has been detected in Reader Tools PDF Reader App 98.8 o... |
medium | 4.4 | — | — | 2026-09-02 | 2026-09-28 |
| CVE-2026-84856 A vulnerability was detected in rowboatlabs rowboat up to 0.9.1. |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-28 |
| CVE-2026-84857 A flaw has been found in sigoden aichat up to 0.30.4. |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-28 |
| CVE-2026-20518 In geniezone, there is a possible information disclosure due to a missing bounds... |
medium | 4.4 | — | — | 2026-09-07 | 2026-09-28 |
| CVE-2026-86239 A vulnerability was identified in liufee FeehiCMS up to 2.1.1. |
medium | 5.3 | — | — | 2026-09-07 | 2026-09-28 |
| CVE-2026-86240 A security flaw has been discovered in liufee FeehiCMS up to 2.1.1. |
medium | 4.7 | — | — | 2026-09-07 | 2026-09-28 |
| CVE-2026-86241 A weakness has been identified in liufee FeehiCMS up to 2.1.1. |
medium | 4.3 | — | — | 2026-09-07 | 2026-09-28 |
| CVE-2026-86244 A security vulnerability has been detected in FastAdmin up to 1.2.0.20210401_bet... |
medium | 4.3 | — | — | 2026-09-07 | 2026-09-28 |
| CVE-2026-86260 A security flaw has been discovered in sfturing hosp_order up to 627f426331da808... |
medium | 6.5 | — | — | 2026-09-07 | 2026-09-28 |
| CVE-2026-86264 A flaw has been found in sfturing ssm_pro up to 627f426331da8086ce8fff2017d65b1d... |
medium | 4.3 | — | — | 2026-09-07 | 2026-09-28 |
| CVE-2026-86314 Integer overflow in the source-bounds check in Memory::init() (src/runtime/Memor... |
medium | 6.2 | — | — | 2026-09-07 | 2026-09-28 |
| CVE-2026-86267 A security vulnerability has been detected in itsourcecode Information System So... |
medium | 6.3 | — | — | 2026-09-07 | 2026-09-28 |
| CVE-2026-86315 An out-of-bounds write caused by numeric truncation Samsung Open Source Escargot... |
medium | 6.2 | — | — | 2026-09-07 | 2026-09-28 |
| CVE-2026-86511 A vulnerability was found in java-json-tools jackson-coreutils 2.0. |
medium | 5.3 | — | — | 2026-09-08 | 2026-09-28 |
| CVE-2026-86512 A vulnerability was identified in java-json-tools json-patch up to 1.13. |
medium | 6.3 | — | — | 2026-09-08 | 2026-09-28 |
| CVE-2026-86513 A security flaw has been discovered in java-json-tools jackson-coreutils 2.0. |
medium | 5.3 | — | — | 2026-09-08 | 2026-09-28 |
| CVE-2026-86514 A weakness has been identified in vgmstream up to r2117. |
medium | 6.3 | — | — | 2026-09-08 | 2026-09-28 |
| CVE-2026-86515 A security vulnerability has been detected in vgmstream up to r2117. |
medium | 4.3 | — | — | 2026-09-08 | 2026-09-28 |
| CVE-2026-86518 A vulnerability has been found in code-projects Student Crud Operation 1.0. |
medium | 6.3 | — | — | 2026-09-08 | 2026-09-28 |
| CVE-2026-92356 A vulnerability was determined in a2ui-project a2ui 0.9/0.9.1. |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-28 |
| CVE-2026-92357 A vulnerability was identified in a2ui-project a2ui 0.8/0.9/1.0. |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-28 |
| CVE-2026-97686 Wind River VxWorks 7 prior to 26.09, specific system call arguments can result i... |
medium | 5.5 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-77516 MaxKB is an open-source AI assistant for enterprise. |
medium | 5.4 | — | — | 2026-09-21 | 2026-09-28 |
| CVE-2026-92361 A security vulnerability has been detected in ag-ui-protocol ag-ui 1.0. |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.