September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-91932 Flowise before 3.1.4 contains a validation bypass vulnerability in MCP server co... |
high | 8.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91933 Flowise before 3.1.4 fails to enforce workspace-level authorization checks in op... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-91934 Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Ch... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91935 Flowise before 3.1.4 fails to validate baseURL parameters in chat-model nodes, a... |
high | 8.3 | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-91929 Flowise versions before 3.1.4 contain cross-tenant authorization gaps in Enterpr... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-91930 Flowise before 3.1.4 fails to scope enterprise organization and workspace member... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-91931 Flowise before 3.1.4 contains a remote code execution vulnerability in the Custo... |
high | 8.5 | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-91848 A vulnerability was identified in WuzhiCMS up to 4.1.0. |
high | 7.3 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-88619 1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in th... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-85013 A flaw was found in environment-modules. |
high | 7.3 | — | — | 2026-09-15 | 2026-10-19 |
| CVE-2026-65831 ArcadeDB is a Multi-Model DBMS. |
high | 7.7 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-59973 FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). |
high | 8.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-59965 Payload Plugins is a collection of plugins designed to enhance Payload CMS. |
high | 7.1 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54076 ArcadeDB is a Multi-Model DBMS. |
high | 8.1 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54077 ArcadeDB is a Multi-Model DBMS. |
high | 7.1 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2024-14029 Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treat... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-28 |
| CVE-2023-54397 Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to imp... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-90650 The MotoPress Hotel Booking plugin for WordPress is vulnerable to Stored Cross-S... |
high | 7.2 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-89025 Hirschmann HiOS Switch Platform devices contain a denial-of-service vulnerabilit... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-88616 An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary c... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-79551 Tenda Technology Co., Ltd NVR_4H CH3 v2.1 V27.5.58.6 was discovered to contain a... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-79425 An authenticated Server-Side Request Forgery (SSRF) in the /adminapi/file/online... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-57586 CodeRAG is a lightweight semantic code search and distillation utility for AI co... |
high | 8.6 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55178 GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and S... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-53957 Contentful MCP Server is a Model Context Protocol server for the Contentful Mana... |
high | 7.7 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54167 Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in s... |
high | 8.2 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-16140 OpenBMC's IPMI implementation, phosphor-net-ipmid, is vulnerable to a logic flaw... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-16141 OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in whic... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-92076 Incorrect boundary conditions in the Networking component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92072 Incorrect boundary conditions in the Safe Browsing component. |
high | 8.0 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92073 Privilege escalation in the Enterprise Policies component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92074 Mitigation bypass in the Popup Blocker component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92064 Sandbox escape due to incorrect boundary conditions in the Widget: Win32 compone... |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92065 Sandbox escape due to incorrect boundary conditions in the Widget: Win32 compone... |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92067 Use-after-free in the Widget: Gtk component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92058 Use-after-free in the Graphics component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92060 Use-after-free in the Internationalization component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92062 Privilege escalation in the Session Restore component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92055 Privilege escalation in the DevTools component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92056 Use-after-free in the Graphics: Text component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.