September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-94084 Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transacti... |
critical | 9.4 | — | Oisf / suricata | 2026-09-20 | 2026-09-28 |
| CVE-2026-93985 OpenPanel js-runtime through 2.3.0 contains a sandbox escape vulnerability in th... |
critical | 9.9 | — | — | 2026-09-19 | 2026-10-02 |
| CVE-2026-78030 DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_ty... |
critical | 9.8 | — | — | 2026-09-19 | 2026-09-22 |
| CVE-2026-93742 A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. |
critical | 9.9 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-86591 The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation... |
critical | 9.8 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-93741 A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. |
critical | 10.0 | — | — | 2026-09-19 | 2026-09-22 |
| CVE-2026-92229 The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plug... |
critical | 9.1 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-89274 The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Ex... |
critical | 9.1 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-84434 The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in... |
critical | 9.8 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-75885 A flaw was found in the OpenShift console. |
critical | 9.3 | — | — | 2026-09-18 | 2026-10-23 |
| CVE-2026-93739 A vulnerability was determined in Totolink A3002MU Hh-B20211125.1046. |
critical | 9.9 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-93740 A vulnerability was identified in Totolink A3002MU Hh-B20211125.1046. |
critical | 10.0 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-93738 A vulnerability was found in Totolink A3002MU Hh-B20211125.1046. |
critical | 9.9 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-57228 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
critical | 9.1 | — | Oisf / suricata | 2026-09-18 | 2026-09-29 |
| CVE-2026-93839 LightLLM through 1.2.0 contains an authentication bypass vulnerability in the /p... |
critical | 9.8 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-84075 IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass securi... |
critical | 9.9 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-84078 IBM Guardium Data Protection 12.2 is vulnerable to a missing authentication vuln... |
critical | 9.9 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-84082 IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbit... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-84031 IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to... |
critical | 9.0 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-84064 IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to... |
critical | 9.9 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-84073 IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to... |
critical | 9.1 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-82967 IBM Guardium Data Protection 12.2 is vulnerable to an authentication bypass that... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-82340 IBM Guardium Data Protection 12.2 is vulnerable to unauthenticated insecure dese... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-82832 IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to... |
critical | 9.6 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-80441 IBM Guardium Data Protection 12.2 is vulnerable to an unauthenticated second-ord... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-81657 IBM Guardium Data Protection 12.2 could allow a remote unauthenticated attacker... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-75878 IBM Sterling File Gateway could allow a remote attacker to bypass authentication... |
critical | 9.1 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-61781 pg_partman is a PostgreSQL extension that manages partitioned tables by time or... |
critical | 9.9 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-58264 FluidSynth is a software synthesizer based on the SoundFont 2 specifications. |
critical | 9.8 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2023-54399 Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/... |
critical | 9.8 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93762 Mongoid contains an unsafe reflection weakness in the query path used for embedd... |
critical | 9.8 | — | Mongodb / mongoid | 2026-09-18 | 2026-09-24 |
| CVE-2026-92701 Cocos AI is a confidential computing system for AI. |
critical | 9.1 | — | — | 2026-09-18 | 2026-10-13 |
| CVE-2026-92702 Cocos AI is a confidential computing system for AI. |
critical | 9.1 | — | — | 2026-09-18 | 2026-10-13 |
| CVE-2026-61550 Icinga 2 is an open source monitoring system. |
critical | 9.8 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-59163 Mnemosyne is a memory layer for artificial intelligence agents. |
critical | 9.1 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2025-66455 LMDeploy is a toolkit for compressing, deploying, and serving large language mod... |
critical | 9.8 | — | — | 2026-09-18 | 2026-10-14 |
| CVE-2026-93765 Mongoid contains an unsafe reflection weakness in the document persistence layer... |
critical | 9.1 | — | Mongodb / mongoid | 2026-09-18 | 2026-09-25 |
| CVE-2026-85497 CareCam CM2507 IP cameras store the device's root-account password using a fixed... |
critical | 9.8 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-81321 CM2507 IP cameras store configured wireless network credentials in cleartext wit... |
critical | 9.8 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-77240 WACRM is a self-hostable CRM template for WhatsApp. |
critical | 9.9 | — | — | 2026-09-18 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.