September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,321
Critical
1,226
High
4,361
Medium
4,108
Low
460
Severity not reported
1,166
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-21391 An improper validation vulnerability exists within PingAM where a well-crafted r... |
not reported | — | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-16726 Buffer overflow vulnerability in Panasonic Industry USB Driver for MINAS A5/A6 a... |
not reported | — | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-90896 Missing Authentication for Critical Function (CWE-306) in the checkout session l... |
not reported | — | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-89308 An unauthenticated OS command injection vulnerability exists in the ping.php end... |
not reported | — | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-87791 A path traversal vulnerability exists in the reserved_file_check function of the... |
not reported | — | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-87792 The "Design Scuole Italia" WordPress theme is affected by multiple Authorization... |
not reported | — | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-87793 The "Design Scuole Italia" WordPress theme is affected by a Reflected XSS vulner... |
not reported | — | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-89307 The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allo... |
not reported | — | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-12258 Inadequate access control in Hiperdino’s REST v1.0 API. |
not reported | — | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-14850 The password reset funcionality is vulnerable to unauthorized account modificati... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-92976 A stored Cross-Site Scripting (XSS) vulnerability in the profile management func... |
not reported | — | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-13326 An out-of-bounds read in Qt NFC's language code length parsing allows a physical... |
not reported | — | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-47839 A vulnerability allows users authenticating through a federated OIDC provider to... |
not reported | — | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-19248 QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-servi... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-76151 Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-14917 A SAML authentication bypass vulnerability affects the Kong SAML plugin when the... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-14916 A JWT signature verification vulnerability affects Kong components that perform... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-8462 SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter befo... |
not reported | — | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-15579 An out-of-bounds write vulnerability exists in some of the Ethernet switches bec... |
not reported | — | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-67399 Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8... |
not reported | — | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-86194 Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving... |
not reported | — | — | — | 2026-09-05 | 2026-09-18 |
| CVE-2026-78223 Improper Verification of Cryptographic Signature vulnerability in team-alembic A... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-80218 Improper Authentication vulnerability in team-alembic AshAuthentication allows a... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-81632 Use of HTTP Request With Sensitive Query String vulnerability in team-alembic As... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-81637 Insufficient Session Expiration vulnerability in team-alembic AshAuthentication... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-82685 Authorization Bypass Through User-Controlled Key vulnerability in team-alembic A... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-82723 Insertion of Sensitive Information into Log File vulnerability in team-alembic A... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-82759 Use of a One-Way Hash with a Predictable Salt vulnerability in team-alembic AshA... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-82760 Inefficient Algorithmic Complexity vulnerability in team-alembic AshAuthenticati... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-82761 Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in team-alembic... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-85500 Authentication Bypass by Primary Weakness vulnerability in team-alembic AshAuthe... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-86522 Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthent... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-86533 Insufficient Session Expiration vulnerability in team-alembic AshAuthentication... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-88952 Improper Authentication vulnerability in team-alembic AshAuthentication allows a... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-91039 Authentication Bypass by Spoofing vulnerability in team-alembic ash_authenticati... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-76949 Authentication Bypass by Spoofing vulnerability in team-alembic ash_authenticati... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-86688 Session Fixation vulnerability in team-alembic ash_authentication allows an atta... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-92932 In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/U... |
not reported | — | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-15600 Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL... |
not reported | — | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-7848 Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL... |
not reported | — | — | — | 2026-09-14 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.