September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-88620 SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorizat... |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-39038 BharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting (... |
medium | 6.1 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-39039 In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authen... |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-39040 BharatMLStack up to and including 1.3.0 is vulnerable to Cross Site Scripting (X... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-79409 An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive in... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-51133 Cross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance... |
medium | 6.1 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-88742 Bacularis 1.0.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in th... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-88743 Bacularis 4.7.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in di... |
medium | 6.1 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-88593 kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpo... |
medium | 6.1 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2021-3030 Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caus... |
medium | 6.1 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-79294 Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-36468 Cross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 allows remote unauth... |
medium | 6.1 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-36470 CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS) in index.php. |
medium | 5.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-36472 CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS). |
medium | 5.2 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-77165 File owners were unable to unlock TYPE_TOKEN locks placed by other users, leavin... |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-79318 web2py 3.2.2-stable (commit a7330a2bf21219fa77860b6665de927dd4f98e6d) is vulnera... |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-79317 A session invalidation flaw exists in x-ui 0.3.2. |
medium | 4.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-88403 A Server-Side Request Forgery (SSRF) in the serverRequest function of nocobase v... |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-88408 FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack ove... |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-88745 EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a... |
medium | 6.1 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-79315 A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. |
medium | 4.7 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-79312 webpy web.py 0.76 is vulnerable to Session Fixation. |
medium | 6.8 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2020-15875 An issue was discovered in LibreNMS 1.65. |
medium | 5.0 | — | — | 2026-09-13 | 2026-09-22 |
| CVE-2022-42917 In FRRouting FRR before 8.5, the service user (usually frr) can escalate its pri... |
medium | 6.7 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-23787 An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 13... |
medium | 4.2 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-23788 An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, an... |
medium | 4.2 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-23790 An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 13... |
medium | 4.2 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-23791 An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 13... |
medium | 4.2 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-23792 An issue was discovered in NR RRC in Samsung Mobile Processor and Modem Exynos 1... |
medium | 4.0 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-33957 An issue was discovered in CustOS Driver in Samsung Mobile Processor Exynos 1580... |
medium | 4.2 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-33964 An issue was discovered in camera in Samsung Mobile Processor Exynos 1580 and 25... |
medium | 6.4 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-29377 An issue was discovered in Softing OPC UA C++ SDK through 6.20 and Softing Secur... |
medium | 6.6 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-25826 An issue was discovered in Keyfactor SignServer before 7.6.0. |
medium | 4.9 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-94185 nvm resolves a requested version or alias by treating it as a filename under $NV... |
medium | 5.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-69771 Improper link resolution before file access ('link following') in Windows Contai... |
medium | 4.7 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-22 |
| CVE-2026-73965 Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone... |
medium | 6.8 | — | Oracle / siebel crm | 2026-09-15 | 2026-09-22 |
| CVE-2026-69792 Concurrent execution using shared resource with improper synchronization ('race... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-22 |
| CVE-2026-69794 Buffer over-read in Windows Encrypting File System (EFS) allows an authorized at... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-22 |
| CVE-2026-86552 SmartLife app dynamically generates brand‑new SmartLife application authenticati... |
medium | 5.4 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-86554 SmartLife app dynamically generates brand‑new SmartLife application authenticati... |
medium | 4.3 | — | — | 2026-09-20 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.