September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87511 Missing authorization in DevTools in Google Chrome prior to 153.0.8010.36 allowe... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-15 |
| CVE-2026-87473 Incorrect authorization in FileHandling in Google Chrome prior to 153.0.8010.36... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-15 |
| CVE-2026-87469 Improper input validation in Extensions in Google Chrome prior to 153.0.8010.36... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-15 |
| CVE-2026-89263 MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEma... |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-15 |
| CVE-2026-89252 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify o... |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-15 |
| CVE-2026-89257 AVideo through 29.0 contains an insecure direct object reference (IDOR) vulnerab... |
medium | 5.4 | — | — | 2026-09-11 | 2026-09-15 |
| CVE-2026-89247 WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier conta... |
medium | 6.1 | — | — | 2026-09-11 | 2026-09-15 |
| CVE-2026-9225 IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated atta... |
medium | 6.5 | — | Langflow / langflow | 2026-09-10 | 2026-09-15 |
| CVE-2026-9667 IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side reque... |
medium | 5.3 | — | Ibm / websphere application server | 2026-09-10 | 2026-09-15 |
| CVE-2026-79513 A divide-by-zero vulnerability in the gf_dash_get_timeline_duration function (sr... |
medium | 6.5 | — | Gpac / gpac | 2026-09-09 | 2026-09-15 |
| CVE-2026-79514 An out-of-bounds read in the gf_dm_data_received function (downloader.c) of GPAC... |
medium | 6.5 | — | Gpac / gpac | 2026-09-09 | 2026-09-15 |
| CVE-2026-79522 An out-of-bounds read in the gf_dm_get_chunk_data function (src/utils/downloader... |
medium | 6.5 | — | Gpac / gpac | 2026-09-09 | 2026-09-15 |
| CVE-2026-87012 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
medium | 4.3 | — | Openwebui / open webui | 2026-09-09 | 2026-09-15 |
| CVE-2026-90786 A vulnerability was determined in Dvidelabs flatcc up to 0.6.3. |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90698 A security flaw has been discovered in memcached 1.6.41/1.6.42/1.6.43. |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90688 A vulnerability was identified in Tenda W20E 15.11.0.61068_1546_841_CN_TDC. |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-78123 strongSwan 5.0.2 through 6.0.7 has an Expired Pointer Dereference in PKCS#7 pars... |
medium | 5.9 | — | Strongswan / strongswan | 2026-09-11 | 2026-09-15 |
| CVE-2026-73029 Buffer over-read in SQL Server allows an authorized attacker to disclose informa... |
medium | 6.5 | — | Microsoft / sql server 2019 | 2026-09-08 | 2026-09-15 |
| CVE-2026-87013 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
medium | 4.3 | — | Openwebui / open webui | 2026-09-09 | 2026-09-15 |
| CVE-2026-87014 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
medium | 6.5 | — | Openwebui / open webui | 2026-09-09 | 2026-09-15 |
| CVE-2026-87015 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
medium | 6.8 | — | Openwebui / open webui | 2026-09-09 | 2026-09-15 |
| CVE-2026-91086 A security vulnerability has been detected in GPAC up to f1219cde. |
medium | 6.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-91088 A vulnerability has been found in GPAC up to f1219cde. |
medium | 4.8 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-91091 A vulnerability was identified in GPAC up to f1219cde. |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90791 A vulnerability was detected in GPAC up to f1219cde. |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90796 A vulnerability was identified in itsourcecode Leave Management System 1.0. |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90810 A security flaw has been discovered in cosmicstack-labs mercury-agent up to 1.1.... |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90815 A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90519 A weakness has been identified in PHPGurukul Bank Locker Management System 1.0. |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90572 A vulnerability was determined in davenardella snap7 up to 1.4.3. |
medium | 4.7 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90577 A vulnerability was detected in GPAC up to f1219cde. |
medium | 5.3 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90582 A vulnerability was identified in evanchiu serverless-todo 1.0.3/2.0.0. |
medium | 5.3 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90488 A vulnerability was determined in Xuxueli xxl-job up to 3.4.2. |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-88896 EspoCRM before 10.0.4 is vulnerable to server-side request forgery. |
medium | 5.3 | — | — | 2026-09-10 | 2026-09-15 |
| CVE-2026-88897 Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials throug... |
medium | 5.9 | — | — | 2026-09-10 | 2026-09-15 |
| CVE-2026-89045 zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length para... |
medium | 4.0 | — | — | 2026-09-10 | 2026-09-15 |
| CVE-2026-88871 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master, 202... |
medium | 4.3 | — | — | 2026-09-10 | 2026-09-15 |
| CVE-2026-88046 rclone is a command-line program to sync files and directories to and from diffe... |
medium | 5.3 | — | — | 2026-09-10 | 2026-09-15 |
| CVE-2026-18063 The Job Postings plugin for WordPress is vulnerable to Stored Cross-Site Scripti... |
medium | 6.4 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-77488 Integer underflow (wrap or wraparound) in SQL Server allows an authorized attack... |
medium | 5.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.