September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,291
Critical
1,223
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-73753 Exploitation through affected command-line operations could allow an authenticat... |
high | 8.8 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-22 |
| CVE-2026-73780 A vulnerability in the web-based management interface of AOS-CX switches exposes... |
high | 8.3 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-22 |
| CVE-2026-92794 OpenSign through 2.41.3 fails to validate caller identity in the getDocument clo... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92804 Nango through 0.70.4 fails to validate caller-supplied connection configuration... |
high | 7.1 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92806 phpList versions before 3.6.17 fail to validate cross-site request forgery token... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92577 In AVideo through 29.0, the API get_api_video endpoint contains a broken access... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92578 WWBN AVideo through 29.0 contains an authentication bypass vulnerability where t... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92580 In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92582 AVideo (WWBN/AVideo) through 29.0 (commit e01e41ecc) is vulnerable to cross-site... |
high | 7.1 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92913 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptograp... |
high | 7.4 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92914 AVideo LoginControl contains an authentication bypass vulnerability in the PGP s... |
high | 8.1 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92915 WWBN AVideo through commit e01e41ecc (no patched version available) contains a b... |
high | 7.3 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92972 SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthen... |
high | 8.6 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92987 roxmltree through 0.21.1 performs quadratic-time attribute and namespace validat... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-93014 RosarioSIS versions before 12.9 fail to validate the filename request parameter... |
high | 7.1 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-93453 SOGo before 5.12.11 constructs password-reset links using the client-supplied Or... |
high | 8.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-81942 PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions bef... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-81944 PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions bef... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93688 SGLang through 0.5.19 in prefill/decode disaggregation mode with Mooncake KV tra... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2019-25776 Weaver E-cology contains an unauthenticated SQL injection vulnerability that all... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93992 Gopeed through 2.0.0-beta.3 contains a path traversal vulnerability in archive e... |
high | 8.1 | — | — | 2026-09-19 | 2026-09-22 |
| CVE-2026-93993 Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the... |
high | 8.8 | — | — | 2026-09-19 | 2026-09-22 |
| CVE-2026-94107 NivoCart through 2.4.0 contains a predictable password reset token vulnerability... |
high | 8.1 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-94412 jshERP through 3.6 contains an authorization bypass vulnerability in the POST /u... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94496 jshERP through 3.6 fails to validate caller permissions in role management endpo... |
high | 8.3 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94497 jshERP through 3.6 fails to validate object ownership in by-id info, update, and... |
high | 8.3 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94501 jshERP through 3.6 contains an authorization bypass vulnerability in the userBus... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-43643 Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an authorizati... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-92792 OpenNHP through 1.0.2 selects its trusted-execution attestation verifier based o... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92592 Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated u... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92593 Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92594 Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the Gra... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92596 Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in th... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92599 joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-89036 Appwrite before 2.0.0 contains an argument injection vulnerability that allows a... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-93292 SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability... |
high | 8.5 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-93426 SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry fie... |
high | 8.5 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-93450 go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93599 rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93658 uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install d... |
high | 7.0 | — | — | 2026-09-18 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.