September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-88756 Pagekit CMS <= 1.0.18 allows an unauthenticated attacker to perform SQL injectio... |
medium | 5.3 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-88412 An integer overflow in the _BulkInsert_ReadProperty component (/bulk_insert.c) o... |
medium | 5.3 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-84448 libheif is a HEIF and AVIF file format decoder and encoder. |
medium | 4.0 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-84451 libheif is a HEIF and AVIF file format decoder and encoder. |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-81182 SysReptor is a fully customizable pentest reporting platform. |
medium | 4.2 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-79304 CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-76899 CordysCRM is an open source AI-powered customer relationship management system t... |
medium | 5.7 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-71537 Paymenter is a free and open-source webshop solution for management of hosting s... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-69190 Graylog is a free and open log management platform. |
medium | 6.3 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-61822 pg_partman is a PostgreSQL extension that manages partitioned tables by time or... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-85720 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
medium | 5.9 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-77281 Caddy is an extensible server platform that uses TLS by default. |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-89027 miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-92255 Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-92257 Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulner... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-92462 yshop-crm through 2.1.3 fails to enforce authorization checks on the CrmFlowCont... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92463 yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-89029 Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged user... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-89031 Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged user... |
medium | 5.4 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92567 TDuck survey form through version 5.0 contains an authorization bypass vulnerabi... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92569 Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in fo... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92603 ContiNew Admin through 4.1.0 contains an authorization bypass vulnerability in t... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92605 IRIS through 2.4.29 fails to properly validate case authorization in comment lis... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92759 SecObserve versions before 1.59.1 contain an information disclosure vulnerabilit... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92781 Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pol... |
medium | 6.3 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-93015 BlueKitchen BTstack through 1.8.2 fails to validate the peer-reported endpoint c... |
medium | 6.3 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-94112 mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use... |
medium | 6.8 | — | — | 2026-09-20 | 2026-09-24 |
| CVE-2026-88339 A NULL pointer dereference vulnerability exists in the gf_sg_vrml_field_clone()... |
medium | 5.5 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-95812 ClipBucket v5 before 5.5.3-#182 contains a reflected cross-site scripting vulner... |
medium | 6.1 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-95815 OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persi... |
medium | 6.3 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-92928 OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains a hardcode... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-92929 OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 trusts an X-Forward... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-92930 OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 uses an administrat... |
medium | 6.2 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96599 Isotope eCommerce through 2.9.10 derives order identifiers from uniqid() instead... |
medium | 5.9 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96600 Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in... |
medium | 5.5 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96674 alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit a... |
medium | 4.4 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96676 A vulnerability was identified in Fast FAC1900R 20190827_2.0.2. |
medium | 6.3 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96680 A vulnerability was detected in ByteDance Coze Scraper Extension up to 2.0.2. |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96739 A flaw has been found in SEMCMS up to 4.2. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97056 SigNoz versions from v0.98.0 up to (but not including) v0.143.0, when configured... |
medium | 6.8 | — | — | 2026-09-24 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.