September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-91772 Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thu... |
medium | 6.1 | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-91774 Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams... |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-85689 llmware 0.4.6 contains an SQL injection vulnerability in the collection-database... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-86114 Arcane versions before 2.0.0 fail to properly restrict template operations, allo... |
medium | 6.5 | — | — | 2026-09-05 | 2026-09-23 |
| CVE-2026-86115 Sim before 0.8.14 classifies tool requests as internal based on URL prefix match... |
medium | 5.0 | — | — | 2026-09-05 | 2026-09-23 |
| CVE-2026-86122 Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allo... |
medium | 5.0 | — | — | 2026-09-05 | 2026-09-23 |
| CVE-2026-89012 Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerab... |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-23 |
| CVE-2026-85177 CRMEB through 6.0.0 fails to validate message ownership in the edit_message hand... |
medium | 5.4 | — | — | 2026-09-03 | 2026-09-23 |
| CVE-2026-85605 Slink before 1.12.3 fails to properly authorize access to image comment endpoint... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-85665 Bruno versions through 4.1.0 fail to validate file paths in request body declara... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-85698 Turso through 0.8.0-pre.8 contains an out-of-bounds read vulnerability in the ta... |
medium | 5.5 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-85700 Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored i... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-86120 APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability... |
medium | 4.3 | — | — | 2026-09-05 | 2026-09-23 |
| CVE-2026-86178 Pixelfed through 0.12.9 fails to validate follower status in StoryComposeControl... |
medium | 5.4 | — | — | 2026-09-05 | 2026-09-23 |
| CVE-2026-91986 gitoxide gix-transport before 0.59.2 fails to filter control characters in git-d... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-85662 Marqo 2.26.0 contains a server-side request forgery vulnerability in the add_doc... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-85676 Dub contains an open redirect vulnerability in the redir_url query parameter tha... |
medium | 4.3 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-49439 OpenRemote is an open-source internet-of-things platform. |
medium | 4.3 | — | — | 2026-09-11 | 2026-09-23 |
| CVE-2026-90467 aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by c... |
medium | 4.0 | — | — | 2026-09-12 | 2026-09-23 |
| CVE-2026-90767 Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in t... |
medium | 6.5 | — | — | 2026-09-13 | 2026-09-23 |
| CVE-2026-90782 S2OPC through 1.7.3 contains a null pointer dereference in msg_subscription_publ... |
medium | 5.3 | — | — | 2026-09-13 | 2026-09-23 |
| CVE-2026-90940 novel-plus through 5.3.3 contains an insecure default cache-management password... |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-55073 WeasyPrint helps web developers to create PDF documents. |
medium | 6.2 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-91199 Refly through 1.1.0 contains a server-side request forgery vulnerability in the... |
medium | 5.0 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-91201 DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-91993 Jpom through 2.11.12 fails to validate workspace ownership when resolving reposi... |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-92973 ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerab... |
medium | 6.1 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-84810 claude-skill-antivirus fails to analyze executable files when scanning local ski... |
medium | 6.5 | — | — | 2026-09-02 | 2026-09-23 |
| CVE-2026-84811 agentverus-scanner fails to analyze compiled Python bytecode files in companion... |
medium | 6.5 | — | — | 2026-09-02 | 2026-09-23 |
| CVE-2026-82522 libjxl before 0.12 contains an integer underflow vulnerability in the container... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-23 |
| CVE-2026-85650 Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in... |
medium | 5.4 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-95868 A weakness has been identified in AdithyaYelloju Restaurant-Management-System up... |
medium | 6.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95820 A vulnerability was found in anirbandutta9 College-Notes-Gallery up to 8c1cf3d98... |
medium | 6.3 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-92881 A security vulnerability has been detected in vgmstream. |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-93504 A vulnerability has been found in SveltyCMS 0.0.6. |
medium | 6.3 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-93533 A vulnerability was determined in spatie Scotty up to 1.4.4. |
medium | 6.3 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-37603 Improper Restriction of Excessive Authentication Attempts in the administration... |
medium | 6.5 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-61834 scim-patch is a library for applying SCIM patch operations. |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93340 Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerabi... |
medium | 6.8 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-94536 lamp-cloud through 5.10.0 fails to validate the employeeId parameter in the /any... |
medium | 4.3 | — | — | 2026-09-21 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.