September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,291
Critical
1,223
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92785 Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo wit... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92788 Coze Studio through 0.5.1 fails to validate that table names in workflow SQL cus... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-88097 Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacke... |
high | 7.8 | — | Microsoft / edge chromium | 2026-09-18 | 2026-09-24 |
| CVE-2026-90776 Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vul... |
high | 7.5 | — | — | 2026-09-13 | 2026-09-24 |
| CVE-2026-91145 Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in p... |
high | 7.1 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-92719 Quickwit through 0.9.0 fails to validate the host and scheme of the queue_url pa... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92763 Rundeck through 6.2.1 fails to properly authorize the importConfig and importNod... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-94056 Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled pro... |
high | 7.5 | — | Exim / exim | 2026-09-19 | 2026-09-24 |
| CVE-2026-85620 Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where fun... |
high | 8.6 | — | — | 2026-09-04 | 2026-09-24 |
| CVE-2026-89147 Net-SNMP through 5.9.5.2 contains a denial of service vulnerability in the SMUX... |
high | 7.5 | — | — | 2026-09-11 | 2026-09-24 |
| CVE-2026-57842 NetBSD contains a use-after-free and double-free vulnerability in msg_recv_copyi... |
high | 7.0 | — | — | 2026-09-11 | 2026-09-24 |
| CVE-2026-90929 File Browser versions >= 2.5.0 and <= 2.63.23 contain an incorrect authorization... |
high | 8.1 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-82035 PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulne... |
high | 7.1 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-89025 Hirschmann HiOS Switch Platform devices contain a denial-of-service vulnerabilit... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-91947 FreeRDP server versions before 3.31.0 contain a use-after-free vulnerability in... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-91964 FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in nego_send... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-84700 PikiwiDB (Pika) v3.5.7 exposes an internal protobuf replication server on a port... |
high | 8.6 | — | — | 2026-09-02 | 2026-09-24 |
| CVE-2026-85179 Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticat... |
high | 8.5 | — | — | 2026-09-03 | 2026-09-24 |
| CVE-2026-85393 node-forge through 1.4.0 fails to validate element count in nested DigestAlgorit... |
high | 7.5 | — | — | 2026-09-03 | 2026-09-24 |
| CVE-2026-82520 parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbou... |
high | 7.5 | — | — | 2026-09-03 | 2026-09-24 |
| CVE-2026-6958 Acunetix 25.11.251107123 for Windows contains a local privilege escalation vulne... |
high | 7.8 | — | — | 2026-09-04 | 2026-09-24 |
| CVE-2026-85660 cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the _v... |
high | 8.1 | — | — | 2026-09-04 | 2026-09-24 |
| CVE-2026-85668 Xinference (affected commit 4a94832, v3.x) contains an unauthenticated arbitrary... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-24 |
| CVE-2026-85673 LLaMA-Factory contains a server-side request forgery vulnerability in the OpenAI... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-24 |
| CVE-2026-85675 OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerabi... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-24 |
| CVE-2026-85699 jina-ai reader contains a server-side request forgery vulnerability where URL va... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-24 |
| CVE-2026-86095 Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in... |
high | 7.8 | — | — | 2026-09-04 | 2026-09-24 |
| CVE-2026-86123 SQL Chat contains four unauthenticated API endpoints that accept client-supplied... |
high | 8.7 | — | — | 2026-09-05 | 2026-09-24 |
| CVE-2026-86177 Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in... |
high | 8.8 | — | — | 2026-09-05 | 2026-09-24 |
| CVE-2026-90769 Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sou... |
high | 7.7 | — | — | 2026-09-13 | 2026-09-24 |
| CVE-2026-90772 Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptio... |
high | 7.6 | — | — | 2026-09-13 | 2026-09-24 |
| CVE-2026-90943 parallax filament-comments through 3.0.0 contains a stored cross-site scripting... |
high | 8.7 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-90944 Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint wit... |
high | 8.2 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-91079 Huly Platform through 0.7.426 contains a server-side request forgery vulnerabili... |
high | 8.5 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-91925 Polyaxon through 2.16.4 renders operation specification fields with an unsandbox... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-91988 atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-89425 UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds t... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-91776 TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches th... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-91777 Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jacks... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-13248 An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec... |
high | 8.8 | — | — | 2026-09-24 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.