September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92417 A vulnerability was found in Open5GS up to 2.8.0. |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92221 A vulnerability was determined in gedelumbung HospitalManagement up to c2d455437... |
medium | 4.7 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-91854 A vulnerability was identified in code-projects Record Management System 1.0. |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-83279 Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Ch... |
medium | 5.5 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-79917 MaxKB is an open-source AI assistant for enterprise. |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-79919 MaxKB is an open-source AI assistant for enterprise. |
medium | 6.3 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-77520 MaxKB is an open-source AI assistant for enterprise. |
medium | 5.4 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-84965 An integer wraparound in an allocation size calculation in the BSON library's JS... |
medium | 5.5 | — | Mongodb / c driver | 2026-09-03 | 2026-09-22 |
| CVE-2026-84966 An incorrect numeric type conversion in the BSON document building component of... |
medium | 5.5 | — | Mongodb / c\+\+ driver | 2026-09-03 | 2026-09-22 |
| CVE-2026-84658 Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBo... |
medium | 4.3 | — | Jenkins / script security | 2026-09-02 | 2026-09-22 |
| CVE-2026-93506 A vulnerability was determined in SveltyCMS 0.0.6. |
medium | 6.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-83419 Vulnerability in the Oracle Communications Cloud Native Core Security Edge Prote... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-83354 Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (compo... |
medium | 6.3 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-75883 The code in pppd that formats a response to a PEAP Request packet in peap_respon... |
medium | 6.8 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-77518 MaxKB is an open-source AI assistant for enterprise. |
medium | 5.0 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-77517 MaxKB is an open-source AI assistant for enterprise. |
medium | 5.4 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-84659 Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce... |
medium | 4.3 | — | Jenkins / script security | 2026-09-02 | 2026-09-22 |
| CVE-2026-93314 A vulnerability was determined in Freedesktop Poppler 26.07.0. |
medium | 6.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93309 A vulnerability was determined in O-RAN-SC SMO OAM 2025-06-10. |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-20516 In MiracastService, there is a possible escalation of privilege due to a confuse... |
medium | 5.5 | — | — | 2026-09-07 | 2026-09-22 |
| CVE-2026-54613 Vvveb is a powerful and easy to use CMS with page builder to build websites, blo... |
medium | 5.4 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-93981 hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a... |
medium | 4.7 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-93955 A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-93965 A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. |
medium | 6.6 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-93685 A flaw was found in the multicluster-observability-addon. |
medium | 5.4 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-93595 ArcadeDB before 26.9.1 contains an access control bypass vulnerability in the qu... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-93013 RAGFlow through 0.27.2 contains a path traversal vulnerability in the dev_insert... |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-21 |
| CVE-2026-92927 A vulnerability was found in SourceCodester Drug Recommendation System 1.0. |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-21 |
| CVE-2026-84450 libheif is a HEIF and AVIF file format decoder and encoder. |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-94148 A vulnerability was determined in ScadaBR up to 1.1. |
medium | 5.3 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94043 A vulnerability was determined in Free5GC up to 4.2.3. |
medium | 5.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94048 A vulnerability was detected in CodeAstro QR Code Attendance Management System 1... |
medium | 6.6 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94090 A security flaw has been discovered in JusticeRage Manalyze 1.0.0. |
medium | 6.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-83346 Vulnerability in the Oracle Fusion Middleware Control product of Oracle Fusion M... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83274 Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Ch... |
medium | 5.5 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-72964 Missing authentication for critical function in Windows Internet Connection Shar... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-21 |
| CVE-2026-72945 Use of uninitialized resource in Windows Task Scheduler allows an authorized att... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-21 |
| CVE-2026-93963 A security vulnerability has been detected in itsourcecode Leave Management Syst... |
medium | 6.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-91971 Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-ba... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-91981 Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the... |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.