September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-40534 An improper neutralization of input during web page generation ('cross-site scri... |
medium | 5.4 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-40535 An improper limitation of a pathname to a restricted directory ('path traversal'... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-40536 An improper limitation of a pathname to a restricted directory ('path traversal'... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-40537 A server-side request forgery (SSRF) vulnerability in PersonMail API in Synology... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-92894 A flaw was found in the foreman_ansible plugin's Ansible override values API. |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-92893 A flaw was found in the foreman_ansible plugin's Ansible inventory API. |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-92904 A flaw was found in the foreman_remote_execution plugin's template invocations c... |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-71568 In BMCtest, Ironic is started without authentication and TLS for the duration of... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-93493 A flaw was found in Netty's `netty-handler-ssl-ocsp` component. |
medium | 5.9 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-93578 A flaw was found in Netty's Online Certificate Status Protocol (OCSP) Client. |
medium | 5.9 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-93653 A denial of service flaw was found in Poppler's Splash backend. |
medium | 5.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-77960 Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read ac... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-86689 Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read ac... |
medium | 5.9 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-81911 Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom... |
medium | 5.4 | — | Concretecms / concrete cms | 2026-09-11 | 2026-09-18 |
| CVE-2026-93596 ArcadeDB before 26.9.1 (com.arcadedb:arcadedb-engine <= 26.8.1) fails to bind th... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-92468 zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vu... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92363 A flaw has been found in ag-ui-protocol ag-ui 1.0. |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-19542 Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to... |
medium | 5.6 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-77117 Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character... |
medium | 5.9 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-80489 Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character en... |
medium | 5.9 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-8674 Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMA... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-1029 IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0... |
medium | 5.4 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-1037 IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-89044 Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.... |
medium | 6.5 | — | Netty / netty | 2026-09-10 | 2026-09-18 |
| CVE-2026-88875 AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-0... |
medium | 4.3 | — | — | 2026-09-10 | 2026-09-18 |
| CVE-2026-87928 MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerabi... |
medium | 5.4 | — | — | 2026-09-09 | 2026-09-18 |
| CVE-2026-87809 Siyuan before v3.8.2 fails to apply publish-access filtering to embedded blocks... |
medium | 6.5 | — | — | 2026-09-09 | 2026-09-18 |
| CVE-2026-87169 Vulnerability in the Oracle Contract Lifecycle Management for Public Sector prod... |
medium | 6.1 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-86739 Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put() when... |
medium | 6.5 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-18 |
| CVE-2026-86255 wger before 2.5 fails to validate the maximum duration of routine date ranges, a... |
medium | 6.5 | — | — | 2026-09-06 | 2026-09-18 |
| CVE-2026-86416 ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vuln... |
medium | 5.4 | — | — | 2026-09-07 | 2026-09-18 |
| CVE-2026-86176 NetBox through 4.7.0 fails to properly scope user-private records in REST and Gr... |
medium | 4.3 | — | — | 2026-09-05 | 2026-09-18 |
| CVE-2026-18555 The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots pl... |
medium | 6.1 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-26947 Dell ECS versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior t... |
medium | 6.7 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92839 Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-84525 A logging issue was addressed with improved data redaction. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-65403 This issue was addressed with improved checks. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-57006 In acfw_ffa.c, there is a possible secret read due to a logic error in the code. |
medium | 4.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-65399 A file quarantine bypass was addressed with additional checks. |
medium | 4.4 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-86869 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.