September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-65114 NVIDIA Infrastructure Controller for Linux contains a vulnerability where an att... |
critical | 9.8 | — | Nvidia / infra controller | 2026-09-22 | 2026-09-29 |
| CVE-2026-95675 D-Link DAP-1360 firmware version 6.14 and earlier contains an unauthenticated re... |
critical | 9.8 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-12718 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
critical | 9.8 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-93616 Check Point Multiple Products Path Traversal Vulnerability |
critical | 9.8 | Listed | Check Point / Multiple Products | 2026-09-22 | 2026-09-23 |
| CVE-2026-74849 Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerab... |
critical | 9.8 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-25254 Improper authorization leads to Remote Code Execution via SocketIO interface. |
critical | 9.8 | — | Qualcomm / software center | 2026-09-22 | 2026-09-25 |
| CVE-2026-93952 Arista VeloCloud Orchestrator Improper Input Validation Vulnerability |
critical | 10.0 | Listed | Arista / VeloCloud Orchestrator | 2026-09-22 | 2026-09-23 |
| CVE-2026-87078 Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buf... |
critical | 9.1 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-87080 Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label t... |
critical | 9.1 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2016-15059 Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow v... |
critical | 9.8 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-19658 The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in... |
critical | 9.8 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-13355 The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to A... |
critical | 9.8 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-94493 A vulnerability was detected in Gigatech PDV5701 1.0.31_240305_112640. |
critical | 10.0 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-78847 An issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript e... |
critical | 9.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-88402 A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allow... |
critical | 9.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-88404 A remote code execution (RCE) vulnerability in the UniscriptExecutionService.exe... |
critical | 9.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-88405 A remote code execution (RCE) vulnerability in the RemoteRegisterFunctionService... |
critical | 9.8 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-79916 MaxKB is an open-source AI assistant for enterprise. |
critical | 9.1 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-77521 MaxKB is an open-source AI assistant for enterprise. |
critical | 10.0 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-67827 Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 all... |
critical | 9.8 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-58491 Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. |
critical | 9.3 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-93012 Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrar... |
critical | 9.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-79920 Ajenti is a Linux & BSD modular server admin panel. |
critical | 9.9 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-85751 Mailu is a mail server distributed as a set of Docker images. |
critical | 9.8 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-36469 CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery (SSRF) in core/mod... |
critical | 9.1 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-94301 The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - accept... |
critical | 9.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-86473 Apache Airflow: the Core API logout endpoint revokes only a session token presen... |
critical | 9.1 | — | Apache / airflow | 2026-09-21 | 2026-09-25 |
| CVE-2026-82187 The Web to Print Online Designer WordPress plugin before 2.15.0 does not validat... |
critical | 9.8 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94101 A security vulnerability has been detected in Netcore NBR200V2 1.3.241127.071246... |
critical | 9.9 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94100 A weakness has been identified in Netcore NBR200V2 1.3.241127.071246. |
critical | 9.9 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94098 A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. |
critical | 9.1 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94099 A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. |
critical | 9.9 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94095 A vulnerability has been found in Netcore NBR200V2 1.3.241127.071246. |
critical | 9.9 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94096 A vulnerability was found in Netcore NBR200V2 1.3.241127.071246. |
critical | 9.9 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94097 A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. |
critical | 10.0 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-94089 A vulnerability was determined in D-Link DIR-868L 2.01b05. |
critical | 10.0 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-90817 An unauthenticated Remote Code Execution vulnerability was found in the survey p... |
critical | 9.8 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-94003 A vulnerability has been found in Comfast CF-N1-S 2.6.0.1. |
critical | 10.0 | — | — | 2026-09-20 | 2026-09-24 |
| CVE-2026-93958 A vulnerability was found in D-Link R95 BE9500_1.00.16. |
critical | 9.1 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94083 Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free,... |
critical | 9.4 | — | Oisf / suricata | 2026-09-20 | 2026-09-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.