September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-78620 The Okta Access Gateway Kerberos configuration handler does not validate file pa... |
medium | 4.9 | — | Okta / access gateway | 2026-09-08 | 2026-09-22 |
| CVE-2026-93737 Azkaban through 4.0.0 omits project permission checks in the ScheduleServlet fet... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93338 Grandstream GWN7660ELR before firmware version 1.0.27.6 contains an information... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-92813 Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.... |
medium | 4.9 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92589 Craft CMS 5.0.0 through 5.10.12 (fixed in 5.10.13) contains a broken access cont... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92590 Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripti... |
medium | 5.4 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92591 Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning... |
medium | 5.9 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92595 Nodemailer (npm package `nodemailer`) versions 9.1.0 and earlier do not honor th... |
medium | 5.9 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92597 Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email a... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92598 Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding intern... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-89038 Verizon Cloud for Android (com.vcast.mediamanager) before 26.7.10 contains a pat... |
medium | 6.2 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-93602 rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL au... |
medium | 4.4 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93689 WinFsp through 2.2.26215 contains a null pointer dereference vulnerability in th... |
medium | 5.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93751 uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDec... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-94108 getID3 through 1.9.26 contains an XML external entity injection vulnerability in... |
medium | 6.5 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-78624 The Okta Access Gateway backup restore function does not validate the filename e... |
medium | 4.9 | — | Okta / access gateway | 2026-09-08 | 2026-09-22 |
| CVE-2026-95624 The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolea... |
medium | 6.8 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-93711 Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response head... |
medium | 6.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-76192 InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that co... |
medium | 5.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-78625 The Okta Access Gateway does not sanitize dashboard label values before writing... |
medium | 6.7 | — | Okta / access gateway | 2026-09-08 | 2026-09-22 |
| CVE-2026-78626 The Okta Access Gateway improperly handles input sanitization and regular expres... |
medium | 6.5 | — | Okta / access gateway | 2026-09-08 | 2026-09-22 |
| CVE-2026-78627 The Okta Hyperdrive Integration installer does not mask the OAuth client secret... |
medium | 5.5 | — | Okta / hyperdrive | 2026-09-08 | 2026-09-22 |
| CVE-2026-78629 The Okta Hyperdrive agent plugin returns a success response without a signed SAM... |
medium | 5.5 | — | Okta / hyperdrive | 2026-09-08 | 2026-09-22 |
| CVE-2026-78630 The Okta Access Gateway does not neutralize shell metacharacters in SNMP configu... |
medium | 6.7 | — | Okta / access gateway | 2026-09-08 | 2026-09-22 |
| CVE-2026-78631 The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local ap... |
medium | 5.5 | — | Okta / hyperdrive | 2026-09-08 | 2026-09-22 |
| CVE-2022-26962 Italtel NFV 11.1.2-20210318 allows Multiple Stored XSS under NP_BCCAS-RMCTRL-01/... |
medium | 5.4 | — | — | 2026-09-10 | 2026-09-22 |
| CVE-2026-36392 FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting (XSS). |
medium | 5.4 | — | — | 2026-09-10 | 2026-09-22 |
| CVE-2026-71642 An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e... |
medium | 4.0 | — | — | 2026-09-10 | 2026-09-22 |
| CVE-2026-79590 A NULL pointer dereference vulnerability exists in the Prism parser component of... |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-22 |
| CVE-2026-79035 A reflected cross-site scripting (XSS) vulnerability in the p.rfihub.com compone... |
medium | 6.1 | — | — | 2026-09-11 | 2026-09-22 |
| CVE-2026-90679 Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a... |
medium | 4.3 | — | — | 2026-09-13 | 2026-09-22 |
| CVE-2026-36989 A SQL Injection vulnerability exists in LuxSoft LuxCal through 5.3.4L via rssfee... |
medium | 5.8 | — | — | 2026-09-13 | 2026-09-22 |
| CVE-2023-34854 HotelDruid before 3.0.6 has insufficient file upload sanitation in the backup/re... |
medium | 6.6 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-40772 A directory Traversal vulnerability in DataEase before 1.18.10 allows a remote a... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-45023 The femanager extension 7 before 7.2.2 for TYPO3 has Incorrect Access Control: i... |
medium | 4.2 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-46035 The svg_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrust... |
medium | 5.9 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-50459 An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-50460 An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-50462 An issue was discovered in the content_consent (aka Content Consent) extension t... |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-88618 1024-lab SmartAdmin v3.30.0 contains a stored cross-site scripting vulnerability... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.