September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84809 Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode... |
medium | 6.5 | — | — | 2026-09-02 | 2026-09-24 |
| CVE-2026-82521 parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an outp... |
medium | 5.3 | — | — | 2026-09-03 | 2026-09-24 |
| CVE-2026-85621 LobeChat (LobeHub) 2.2.1 does not properly verify inbound chat-platform webhook... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-24 |
| CVE-2026-85693 Chatbot UI contains an authorization bypass vulnerability in the retrieval endpo... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-24 |
| CVE-2026-85697 Documenso 2.17.0 contains an access control vulnerability in the PDF-serving end... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-24 |
| CVE-2026-86116 Metabase versions before 0.63.1 fail to enforce data analyst permission checks o... |
medium | 6.5 | — | — | 2026-09-05 | 2026-09-24 |
| CVE-2026-89145 Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin dir... |
medium | 4.2 | — | — | 2026-09-11 | 2026-09-24 |
| CVE-2026-82535 Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vuln... |
medium | 6.1 | — | — | 2026-09-11 | 2026-09-24 |
| CVE-2026-91922 Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scriptin... |
medium | 6.1 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-91997 evolution-api through 2.3.7 contains an incorrect array comparison in the metric... |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-89030 Adenion Blog2Social plugin for WordPress before 9.1.0 exposes the email addresse... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-94057 Exim before 4.100.1 allows SMTP smuggling in which the received message does not... |
medium | 5.3 | — | Exim / exim | 2026-09-19 | 2026-09-24 |
| CVE-2026-90927 filebrowser through 2.63.23 fails to limit WebSocket message size in the /api/co... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-85670 tokenizers (Hugging Face) is affected by an out-of-bounds buffer access in BpeBu... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-24 |
| CVE-2026-7208 Yealink SIP-T33G firmware versions 124.86.x.x prior to 124.87.0.0 contain a race... |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-82019 TripleLift's ad rendering script (video-bundle.js) contains a DOM-based cross-si... |
medium | 4.2 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-91994 Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-81912 Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Mov... |
medium | 5.7 | — | Concretecms / concrete cms | 2026-09-11 | 2026-09-24 |
| CVE-2026-48073 Docmost is open-source collaborative wiki and documentation software. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-65827 Docmost is open-source collaborative wiki and documentation software. |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-81913 Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via th... |
medium | 6.1 | — | Concretecms / concrete cms | 2026-09-11 | 2026-09-24 |
| CVE-2026-81915 Concrete CMS below 9.5.3 does not perform an object-level authorization check wh... |
medium | 5.3 | — | Concretecms / concrete cms | 2026-09-11 | 2026-09-24 |
| CVE-2026-68535 Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not... |
medium | 4.3 | — | Concretecms / concrete cms | 2026-09-11 | 2026-09-24 |
| CVE-2026-70575 Null pointer dereference in Windows Schannel allows an authorized attacker to de... |
medium | 6.5 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-24 |
| CVE-2026-76902 CordysCRM is an open source AI-powered customer relationship management system t... |
medium | 5.0 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-78310 Authorization Bypass Through User-Controlled Key in DIAEnergie. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-78313 Improper Access Control in DIAEnergie. |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-79758 Termix is a web-based server management platform with SSH terminal, tunneling, a... |
medium | 5.4 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-79763 Termix is a web-based server management platform with SSH terminal, tunneling, a... |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-65422 A flaw in the authorization mechanism for Media Gateway API in Genetec Security... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-19532 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-88916 Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Privileg... |
medium | 6.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-77703 Key exchange without entity authentication vulnerability in HAVELSAN Inc. |
medium | 5.9 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-77707 Improper certificate validation vulnerability in HAVELSAN Inc. |
medium | 5.9 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-48072 Docmost is open-source collaborative wiki and documentation software. |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97226 A vulnerability has been found in DbGate up to 7.2.5/7.3.1-premium-beta.1. |
medium | 6.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-91133 Discourse is an open-source discussion platform. |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-91120 Discourse is an open-source discussion platform. |
medium | 5.4 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-91121 Discourse is an open-source discussion platform. |
medium | 5.0 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-84302 Discourse is an open-source discussion platform. |
medium | 4.2 | — | — | 2026-09-24 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.