September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92247 A security vulnerability has been detected in synaptikcms synaptik-cms up to 1.3... |
medium | 4.7 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-84589 A permissions issue was addressed with additional restrictions. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-76865 Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerabi... |
medium | 4.9 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-76855 Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure v... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-73460 On affected platforms running Arista EOS with IS-IS graceful restart enabled, an... |
medium | 6.1 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-91968 vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91983 Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task re... |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91970 Vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91980 vikunja before 2.6.0 fails to validate team access when attaching teams to proje... |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-81165 Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. |
medium | 5.3 | — | Blazy Project / blazy | 2026-09-02 | 2026-09-16 |
| CVE-2026-91198 GrowthBook through 5.0.1 returns unredacted fact table definitions including raw... |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-91773 Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by r... |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-81166 Missing Authorization vulnerability in Drupal Digital Signage Framework allows F... |
medium | 5.3 | — | Lakedrops / digital signage framework | 2026-09-02 | 2026-09-16 |
| CVE-2026-88914 A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. |
medium | 4.4 | — | — | 2026-09-11 | 2026-09-16 |
| CVE-2026-77159 A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() fun... |
medium | 5.5 | — | — | 2026-09-11 | 2026-09-16 |
| CVE-2026-89298 A flaw was found in the Dynamic Client Registration service of Keycloak, an open... |
medium | 4.9 | — | — | 2026-09-11 | 2026-09-16 |
| CVE-2026-89329 A flaw was found in `multipathd`. |
medium | 6.2 | — | — | 2026-09-11 | 2026-09-16 |
| CVE-2026-90463 A flaw was found in the sssd NSS responder. |
medium | 4.0 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90994 A flaw was found in sssd, specifically within the PAM (Pluggable Authentication... |
medium | 4.0 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-81303 A flaw was found in hawtio-operator. |
medium | 6.3 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91786 A flaw was found in GNOME Shell. |
medium | 6.1 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-92091 A flaw was found in jwcrypto. |
medium | 5.9 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-19607 A flaw was found in the first-broker-login flow of the keycloak-services compone... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-87123 hbs is an Express view engine wrapper for Handlebars. |
medium | 5.9 | — | — | 2026-09-11 | 2026-09-16 |
| CVE-2026-87859 morgan is an HTTP request logger middleware for Node.js. |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-16 |
| CVE-2026-88932 multer is a Node.js middleware for handling multipart/form-data uploads. |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-17495 moment is a JavaScript date library for parsing, validating, manipulating, and f... |
medium | 5.9 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-86472 fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify a... |
medium | 4.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-86818 fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify a... |
medium | 4.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-62597 Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle E... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-70755 Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracl... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-83076 Vulnerability in the Oracle HR Intelligence product of Oracle E-Business Suite (... |
medium | 6.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-92081 fastify is a fast and low-overhead web framework for Node.js. |
medium | 5.9 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-43741 A logic issue was addressed with improved state management. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-87727 a-blog cms Ver. |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-16 |
| CVE-2026-82763 Cross-site scripting vulnerability exists in Contec FX5000 series, FX4000 series... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82764 Cross-site request forgery vulnerability exists in multiple Contec products. |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82767 Cross-site scripting vulnerability exists in SGA1000. |
medium | 5.2 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82769 Cross-site scripting vulnerability exists in Contec RP-WAH-SR Series. |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82771 Cross-site scripting vulnerability exists in Contec EC1000 series. |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.