September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,291
Critical
1,223
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86090 ntopng before 6.7.260717 fails to perform authorization checks in the delete end... |
high | 7.1 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-86091 ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete... |
high | 7.1 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-86098 ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in th... |
high | 7.4 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-86169 Axolotl before 0.19.0 contains a remote code execution vulnerability in the mult... |
high | 8.8 | — | — | 2026-09-05 | 2026-09-23 |
| CVE-2026-89011 isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the... |
high | 7.1 | — | — | 2026-09-10 | 2026-09-23 |
| CVE-2026-89013 Dolibarr 23.0.4 before 24.0.1 contains an authorization bypass vulnerability tha... |
high | 7.5 | — | — | 2026-09-11 | 2026-09-23 |
| CVE-2026-85395 UnoPim before 2.1.3 fails to include integration store, update, and key-generati... |
high | 7.1 | — | — | 2026-09-03 | 2026-09-23 |
| CVE-2026-82527 R2R through 3.6.6 contains a SQL injection vulnerability that allows unauthentic... |
high | 7.5 | — | — | 2026-09-03 | 2026-09-23 |
| CVE-2026-85606 firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-85626 git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref an... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-85666 OGX (formerly Llama Stack, affected at commit fbe8e0f) contains an unauthenticat... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-9317 Nango before 0.71.6 contains a missing authentication vulnerability in the runne... |
high | 8.1 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-86173 MindsDB through 26.1.0 contains a server-side request forgery vulnerability in t... |
high | 7.5 | — | — | 2026-09-05 | 2026-09-23 |
| CVE-2026-86185 Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wi... |
high | 8.0 | — | — | 2026-09-05 | 2026-09-23 |
| CVE-2026-10144 Rsbuild before 2.0.9 contains a command injection vulnerability that allows atta... |
high | 7.8 | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-90556 Freeciv versions before 3.2.6 contain a heap buffer overflow in worklist_load()... |
high | 7.8 | — | — | 2026-09-12 | 2026-09-23 |
| CVE-2026-90770 Spug through 3.4.0 contains a remote code execution vulnerability in the ping_ch... |
high | 8.8 | — | — | 2026-09-13 | 2026-09-23 |
| CVE-2026-90777 ESPnet before 202609 deserializes pretrained model checkpoints using torch.load... |
high | 8.8 | — | — | 2026-09-13 | 2026-09-23 |
| CVE-2026-90779 SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthH... |
high | 7.5 | — | — | 2026-09-13 | 2026-09-23 |
| CVE-2026-90780 SIPp through 3.7.7 contains a buffer overflow vulnerability in the get_header()... |
high | 7.5 | — | — | 2026-09-13 | 2026-09-23 |
| CVE-2026-90933 laradashboard through 1.2.2 contains a missing authorization vulnerability in th... |
high | 7.1 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-90938 LangBot's plugin runtime (pip package langbot_plugin) through 0.4.17 starts a de... |
high | 8.6 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-90946 DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerabili... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-91080 webhook through 2.8.3 reads the entire request body into memory before evaluatin... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-91924 pgweb through 0.17.0 leaves the POST /api/connect endpoint unguarded when connec... |
high | 8.5 | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-84484 ION-DTN versions before 4.2.0 contain an out-of-bounds read vulnerability in the... |
high | 7.5 | — | — | 2026-09-02 | 2026-09-23 |
| CVE-2026-84485 APITable through 1.13.0-beta.1 exposes the internal organization loadOrSearch en... |
high | 7.5 | — | — | 2026-09-02 | 2026-09-23 |
| CVE-2026-85176 DbGate fails to validate jslid parameters in the jsldata controller, allowing au... |
high | 8.8 | — | — | 2026-09-03 | 2026-09-23 |
| CVE-2026-85651 Trigger.dev versions before 4.5.2 fail to validate environment membership during... |
high | 8.5 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-89146 libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in di... |
high | 7.5 | — | — | 2026-09-11 | 2026-09-23 |
| CVE-2026-95831 Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware... |
high | 7.8 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-78442 Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to... |
high | 8.8 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-23 |
| CVE-2026-83093 Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component... |
high | 8.6 | — | Oracle / forms | 2026-09-15 | 2026-09-23 |
| CVE-2026-83041 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
high | 7.7 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-23 |
| CVE-2026-83034 Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware... |
high | 7.5 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-23 |
| CVE-2026-83033 Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware... |
high | 8.8 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-23 |
| CVE-2026-83032 Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware... |
high | 8.8 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-23 |
| CVE-2026-95925 A vulnerability was found in SourceCodester Online Reviewer Management System 1.... |
high | 7.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95926 A vulnerability was determined in SourceCodester Online Reviewer Management Syst... |
high | 7.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95819 A vulnerability has been found in anirbandutta9 College-Notes-Gallery up to 8c1c... |
high | 7.3 | — | — | 2026-09-22 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.