September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-97232 A vulnerability was determined in volotat Anagnorisis up to 0.4.2. |
medium | 6.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97321 A vulnerability has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.... |
medium | 6.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97323 A vulnerability was determined in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.... |
medium | 6.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-48540 Krayin CRM through 2.2.6 contains a stored client-side template injection vulner... |
medium | 5.4 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-90775 PostGIS address_standardizer through 3.7.0 fails to validate the Weight paramete... |
medium | 6.5 | — | — | 2026-09-13 | 2026-09-24 |
| CVE-2026-92775 Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-88341 A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .y... |
medium | 5.5 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-88384 OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing... |
medium | 5.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-57843 NetBSD contains an information disclosure vulnerability in mm_open() within sys/... |
medium | 5.5 | — | — | 2026-09-11 | 2026-09-24 |
| CVE-2026-89021 MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the c... |
medium | 6.9 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-92750 Harness through 3.3.0 omits access control validation in the infrastructure prov... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92770 Harbor through 2.15.2 fails to properly restrict the q query parameter filtering... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-97224 A vulnerability was detected in Excalidraw up to 0.18.1. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96745 Deserialization of untrusted data in the command monitoring support of the Mongo... |
medium | 5.6 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96746 An out-of-bounds write in the connection-monitoring logic of the MongoDB C Drive... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96747 The client-side field level encryption support in the MongoDB Python Driver can... |
medium | 5.0 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-84712 A flaw was found in the automation-controller API. |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-97177 A flaw was found in the user update mechanism of the Keycloak Admin REST API. |
medium | 6.6 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97311 A flaw was found in the Admin REST API of Keycloak, an identity and access manag... |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-77798 Velociraptor contains a deadlock condition that may be triggered by authenticate... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-93541 An out-of-bounds read in libXi's XQueryDeviceState() in libXi before 1.8.4 could... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-93542 An out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_c... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-93544 An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in libXi before... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-93545 An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-94281 An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi befo... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96748 PyMongo's connection string parsing decodes percent-encoded characters in the ho... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-91987 atomic-agents-stack before 1.1.0 contains a cost-guardrail bypass in the _estima... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-92459 yshop-crm through 2.1.3 contains a missing authorization vulnerability in the Cr... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92765 ArcherySec through 2.0.6 fails to validate organization ownership in the WebScan... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92790 Higress before 2.2.4 panics when processing a Cookie header segment without an e... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92795 Coze Studio through 0.5.1 fails to restrict the server URL supplied when registe... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-94054 Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled pro... |
medium | 5.3 | — | Exim / exim | 2026-09-19 | 2026-09-24 |
| CVE-2026-90781 alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_asci... |
medium | 4.4 | — | — | 2026-09-13 | 2026-09-24 |
| CVE-2026-92774 Wiki.js through 2.5.314 omits page tags from authorization checks in multiple Gr... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-94055 Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS,... |
medium | 5.3 | — | Exim / exim | 2026-09-19 | 2026-09-24 |
| CVE-2026-90928 File Browser through 2.63.23 contains a memory exhaustion vulnerability in the s... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-90930 File Browser through 2.63.23 applies path rules to the requested lexical path bu... |
medium | 6.8 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-89020 MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-91197 Flowable flowable-engine through 8.0.0 contains an XML external entity injection... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-56719 MikroTik RouterOS before 7.24 contains an out-of-bounds read vulnerability in th... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.