September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-90700 A security vulnerability has been detected in itsourcecode Sales and Inventory S... |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90705 A vulnerability was determined in D-Link DWR-M921 1.1.52. |
medium | 6.6 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90598 A vulnerability was detected in jaygajera17 E-commerce-project-springBoot up to... |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90580 A vulnerability was found in FlowiseAI Flowise up to 3.0.2. |
medium | 6.3 | — | Flowiseai / flowise | 2026-09-13 | 2026-09-16 |
| CVE-2026-90565 A security flaw has been discovered in Rizwan17 inventory-management-system up t... |
medium | 5.3 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90527 A vulnerability was detected in quequnlong shiyi-blog up to 1.2.1. |
medium | 4.3 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90517 A vulnerability was identified in PHPGurukul Bank Locker Management System 1.0. |
medium | 5.3 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2023-51769 Frappe before 14.49.0 allows an XSS attack that is associated with blog pages an... |
medium | 6.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-87994 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
medium | 4.3 | — | Openwebui / open webui | 2026-09-09 | 2026-09-16 |
| CVE-2026-87997 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
medium | 4.3 | — | Openwebui / open webui | 2026-09-09 | 2026-09-16 |
| CVE-2026-87818 GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff... |
medium | 6.5 | — | Gitpython Project / gitpython | 2026-09-09 | 2026-09-16 |
| CVE-2026-68842 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-16 |
| CVE-2026-65407 A use after free issue was addressed with improved memory management. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-65412 A null pointer dereference was addressed with improved input validation. |
medium | 6.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-65413 An integer overflow was addressed with improved input validation. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-84541 An input validation issue was addressed with improved input validation. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-90496 A vulnerability was found in Fengoffice Feng Office up to 3.11.13.11. |
medium | 4.7 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90501 A security vulnerability has been detected in lenve vhr 1.0-SNAPSHOT. |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90506 A vulnerability was determined in vvbbnn00 WARP-Clash-API up to c7bf236007395986... |
medium | 5.0 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90511 A vulnerability was detected in GongShengyue OnlineBooks up to dfc5eacc08d3b0396... |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-84534 A path handling issue was addressed with improved validation. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-18061 Improper restriction of XML external entity references in the RemoteQueryCachePl... |
medium | 5.9 | — | Amazon / advanced jdbc wrapper | 2026-09-11 | 2026-09-16 |
| CVE-2026-89332 Inclusion of functionality from an untrusted control sphere in the Kiro Powers f... |
medium | 5.5 | — | Amazon / kiro ide | 2026-09-11 | 2026-09-16 |
| CVE-2026-48987 pyLoad is a free and open-source download manager written in Python. |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91855 A security flaw has been discovered in Open5GS up to 2.7.7. |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-57128 PraisonAI is a multi-agent teams system. |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-91021 Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site script... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-54246 Skipper is an HTTP router and reverse proxy for service composition. |
medium | 5.7 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-76081 ZITADEL is an open source identity management platform. |
medium | 5.5 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-86118 gonic versions before 0.22.0 fail to validate administrator privileges in the st... |
medium | 4.3 | — | — | 2026-09-05 | 2026-09-16 |
| CVE-2026-29810 CyberPanel before 2.4.4 omits a "return 0" that is required by the business logi... |
medium | 4.3 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-29812 CyberPanel before 2.4.4 has no logging for actions that could potentially manipu... |
medium | 4.3 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-49837 GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go P... |
medium | 5.9 | — | — | 2026-09-10 | 2026-09-16 |
| CVE-2026-49838 GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go P... |
medium | 5.9 | — | — | 2026-09-10 | 2026-09-16 |
| CVE-2026-86174 Plane through 1.4.2 fails to validate that issues belong to the deploy board's p... |
medium | 4.3 | — | — | 2026-09-05 | 2026-09-16 |
| CVE-2026-84701 NocoBase fails to sanitize rich text field values in the read renderer, allowing... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-16 |
| CVE-2026-67633 Out-of-bounds read in SQL Server allows an authorized attacker to deny service o... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-16 |
| CVE-2026-67386 Use of uninitialized resource in SQL Server allows an authorized attacker to dis... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-16 |
| CVE-2026-67383 Generation of error message containing sensitive information in SQL Server allow... |
medium | 6.5 | — | Microsoft / sql server 2025 | 2026-09-08 | 2026-09-16 |
| CVE-2026-67369 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / sql server 2025 | 2026-09-08 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.