September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92173 Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be indu... |
critical | 9.1 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-51872 Devika v1.0 is vulnerable to Code Injection via the Runner.run_code function in... |
critical | 9.8 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-51861 bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/bac... |
critical | 9.8 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-51862 DB-GPT 0.8.0 contains directory traversal in skill_upload (packages/dbgpt-app/sr... |
critical | 9.1 | — | — | 2026-09-30 | 2026-10-07 |
| CVE-2026-51864 DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (pac... |
critical | 9.1 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-51866 In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/uplo... |
critical | 9.8 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-51867 agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/ap... |
critical | 9.8 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-51869 DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code... |
critical | 9.8 | — | — | 2026-09-30 | 2026-10-07 |
| CVE-2026-51870 DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/she... |
critical | 9.8 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-51871 Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in sr... |
critical | 9.8 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-51856 In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes... |
critical | 9.8 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-51857 In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can ru... |
critical | 9.8 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-51858 In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shell_exec... |
critical | 9.8 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-51859 bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in sa... |
critical | 9.1 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-102147 A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an un... |
critical | 9.3 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102149 Kiteworks Email Protection Gateway did not sufficiently restrict which account a... |
critical | 9.4 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102115 Kiteworks Core did not correctly validate a parameter submitted to the password... |
critical | 9.8 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102102 Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-... |
critical | 9.1 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-08 |
| CVE-2026-102103 Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-... |
critical | 9.1 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-08 |
| CVE-2026-102104 Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-... |
critical | 9.1 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-08 |
| CVE-2026-102105 Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-... |
critical | 9.1 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-08 |
| CVE-2026-102106 Improper authentication in a Kiteworks Email Protection Gateway administrative s... |
critical | 9.1 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-08 |
| CVE-2026-102095 Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-... |
critical | 9.1 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-08 |
| CVE-2026-55107 Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applic... |
critical | 10.0 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103475 yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP a... |
critical | 9.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-100512 Contributor PHP Object Injection in Nested Pages <= 3.3.2 versions. |
critical | 9.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-62308 Tugtainer is a self-hosted app for automating updates of Docker containers. |
critical | 9.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-55494 Tugtainer is a self-hosted app for automating updates of Docker containers. |
critical | 9.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-55176 Soft Machine is a Virtual Machine–based agentic development environment / Cloud... |
critical | 9.0 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-55181 Tugtainer is a self-hosted app for automating updates of Docker containers. |
critical | 9.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102489 Zammad GmbH Zammad Session Fixation Vulnerability |
critical | 9.8 | Listed | Zammad GmbH / Zammad | 2026-09-30 | 2026-10-10 |
| CVE-2026-102427 Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaS... |
critical | 10.0 | — | Ordasoft / joomla cck | 2026-09-30 | 2026-10-01 |
| CVE-2026-100277 In JetBrains YouTrack before 2026.2.19197 account takeover was possible by repla... |
critical | 9.8 | — | Jetbrains / youtrack | 2026-09-30 | 2026-10-02 |
| CVE-2026-100273 In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts de... |
critical | 9.8 | — | Jetbrains / youtrack | 2026-09-30 | 2026-10-02 |
| CVE-2026-100255 In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 administrator account... |
critical | 9.8 | — | Jetbrains / teamcity | 2026-09-30 | 2026-10-02 |
| CVE-2026-76570 Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and writ... |
critical | 9.1 | — | Joomcode / jc tables | 2026-09-30 | 2026-10-06 |
| CVE-2026-18782 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
critical | 9.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103395 LightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC se... |
critical | 9.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-82307 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
critical | 9.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97274 Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO (OAuth Client... |
critical | 9.8 | — | — | 2026-09-30 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.