September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-96880 A vulnerability was found in TaleLin lin-cms-spring-boot up to 0.2.1. |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96881 A vulnerability was determined in TaleLin lin-cms-spring-boot up to 0.2.1. |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96884 A security flaw has been discovered in MantisZip up to 0.4.5. |
medium | 6.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96892 A flaw has been found in Edimax BR-6428nC 1.16. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-15731 The WP Multilang – Translation and Multilingual Plugin plugin for WordPress is v... |
medium | 6.4 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-16302 The Spectra Legacy – Gutenberg Blocks plugin for WordPress is vulnerable to Sens... |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-94102 A flaw has been found in WuzhiCMS up to 4.1.0. |
medium | 4.3 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-78806 An issue in Matter Standard Specification-Implementation gap v1.5.1 Matter Proje... |
medium | 5.5 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-94050 A vulnerability has been found in D-Link DIR-X1860Z up to 1.0.2.220120.165402. |
medium | 4.3 | — | — | 2026-09-20 | 2026-09-24 |
| CVE-2026-94092 A vulnerability was detected in dmlc dgl up to 2.1.0. |
medium | 5.5 | — | — | 2026-09-20 | 2026-09-24 |
| CVE-2026-94035 A vulnerability was determined in SourceCodester Drug Recommendation System 1.0. |
medium | 4.3 | — | — | 2026-09-20 | 2026-09-24 |
| CVE-2026-94040 A flaw has been found in vas3k TaxHacker up to 0.8.5. |
medium | 5.3 | — | — | 2026-09-20 | 2026-09-24 |
| CVE-2026-79320 Stencil core 4.43.5 contains a DOM-based cross-site scripting (XSS) vulnerabilit... |
medium | 6.1 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2025-43200 Apple Multiple Products Unspecified Vulnerability |
medium | 4.2 | Listed | Apple / Multiple Products | 2025-06-16 | 2026-09-24 |
| CVE-2026-91960 FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's Stream_Ens... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-91959 FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rts_read_... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-91958 FreeRDP versions before 3.31.0 fail to validate MonitorIds array values when par... |
medium | 6.6 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-91956 FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the URBDRC... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-91954 FreeRDP before 3.31.0 contains a null pointer dereference vulnerability in gdi_s... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-91953 FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in n... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-91952 FreeRDP versions before 3.31.0 contain an infinite-loop denial of service in the... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-91951 FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in t... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-91950 FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the rdpdr_... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-91946 FreeRDP versions before 3.31.0 contain an information disclosure vulnerability i... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-91945 FreeRDP versions before 3.31.0 contain an out-of-bounds read vulnerability in sm... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-84470 A flaw was found in Ansible Automation Platform's automation-controller (AWX). |
medium | 6.4 | — | — | 2026-09-01 | 2026-09-24 |
| CVE-2026-71458 URLModificationMiddleware resolves named-URL lookups
against unfiltered Model.o... |
medium | 5.0 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-71460 /api/v2/config/ is protected only by IsAuthenticated. |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-71462 StringListPathField.to_internal_value() calls
os.path.exists() on unbounded use... |
medium | 4.1 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-88015 rclone is a command-line program to sync files and directories to and from diffe... |
medium | 5.3 | — | Rclone / rclone | 2026-09-10 | 2026-09-23 |
| CVE-2026-88014 rclone is a command-line program to sync files and directories to and from diffe... |
medium | 6.3 | — | Rclone / rclone | 2026-09-10 | 2026-09-23 |
| CVE-2026-83530 A user could provide an expression whose string length is longer than the Parser... |
medium | 4.3 | — | Google / common expression language | 2026-09-09 | 2026-09-23 |
| CVE-2026-88013 rclone is a command-line program to sync files and directories to and from diffe... |
medium | 5.3 | — | Rclone / rclone | 2026-09-10 | 2026-09-23 |
| CVE-2026-21113 Improper export of android application components in Visual Voicemail prior to v... |
medium | 5.5 | — | Samsung / visual voicemail | 2026-09-09 | 2026-09-23 |
| CVE-2026-21108 Improper export of android application components in Bixby Touch prior to versio... |
medium | 5.5 | — | Samsung / bixby | 2026-09-09 | 2026-09-23 |
| CVE-2026-21112 Improper input validation in Samsung Tips prior to Android 17 allows local attac... |
medium | 5.5 | — | Samsung / android | 2026-09-09 | 2026-09-23 |
| CVE-2026-21107 Out-of-bounds write in Samsung Notes prior to version 4.4.45.5 allows local atta... |
medium | 5.5 | — | Samsung / notes | 2026-09-09 | 2026-09-23 |
| CVE-2026-77955 In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONE... |
medium | 4.4 | — | Nlnetlabs / unbound | 2026-09-16 | 2026-09-23 |
| CVE-2026-21105 Improper access control in Collection prior to version 1.0.1.14 in Android 15 an... |
medium | 5.5 | — | Samsung / collection | 2026-09-09 | 2026-09-23 |
| CVE-2026-95592 Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versio... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.