September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-12667 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 throu... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-12728 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 throu... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-11929 IBM Security Verify Identity Access Reverse Proxy in certain configurations may... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-11934 IBM Verify Identity Access could allow an administrator to execute additional co... |
high | 7.2 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-12101 IBM Verify Identity Access could allow an administrator to execute additional co... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-12150 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 throu... |
high | 7.0 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-12354 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 throu... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-12355 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 throu... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2025-66974 An issue in Prolink 13A Smart Plug Model Version: DS-3202M-UKv3 Wi-Fi and Applic... |
high | 7.5 | — | — | 2026-09-15 | 2026-10-28 |
| CVE-2026-11728 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 throu... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-11729 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 throu... |
high | 8.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-11926 IBM Verify Identity Access could allow a remote attacker to cause a denial of se... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91853 A vulnerability has been found in TOTOLINK X5000R 9.1.0cu.2089_B20211224. |
high | 7.4 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-89022 BookStack before 26.05.5 contains an authentication bypass vulnerability in its... |
high | 7.4 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-81895 In Concrete CMS before 9.5.3, the Document Library block stored the file-set ide... |
high | 7.2 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-22 |
| CVE-2026-58200 Payload Plugins is a collection of plugins designed to enhance Payload CMS. |
high | 7.1 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-59160 Yeger is a monorepo for npm packages maintained under the yeger scope. |
high | 8.8 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-63443 Coder allows organizations to provision remote development environments via Terr... |
high | 8.3 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55690 The EmbedVideo Extension is a MediaWiki extension which adds a parser function c... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55691 The EmbedVideo Extension is a MediaWiki extension which adds a parser function c... |
high | 8.6 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55692 The EmbedVideo Extension is a MediaWiki extension which adds a parser function c... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55149 Vouch Proxy is an SSO and OAuth/OIDC login solution for Nginx using the auth_req... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-18110 Concrete CMS 9 (9.0.0 through 9.5.2) does not perform an authorization check on... |
high | 7.5 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-22 |
| CVE-2026-19780 Koha Eval Code Injection Remote Code Execution Vulnerability. |
high | 8.8 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-91989 atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in the... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-91990 Tornado before 6.5.8 contains a memory amplification vulnerability in parse_mult... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91985 Vikunja before 2.6.0 fails to properly restrict access to the link-share hash fi... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91988 atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-91972 Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public auth... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-91973 Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV B... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91964 FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in nego_send... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-91965 WWBN AVideo through 29.0 fails to enforce user-group restrictions in the plugin/... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91955 FreeRDP before 3.31.0 fails to validate client-supplied DesktopWidth and Desktop... |
high | 7.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-91947 FreeRDP server versions before 3.31.0 contain a use-after-free vulnerability in... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-91948 FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in s... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-91941 Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerabilit... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-91943 Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PD... |
high | 7.7 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91937 Flowise before 3.1.4 fails to sanitize the overrideConfig.sessionId parameter be... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-91938 Flowise versions before 3.1.4 contain a server-side request forgery vulnerabilit... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-91940 crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFConte... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.