September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-57112 PraisonAI is a multi-agent teams system. |
high | 8.3 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-57133 PraisonAI is a multi-agent teams system. |
high | 8.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-57134 PraisonAI is a multi-agent teams system. |
high | 8.2 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-57135 PraisonAI is a multi-agent teams system. |
high | 7.6 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-57136 PraisonAI is a multi-agent teams system. |
high | 8.8 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-1758 Session fixation vulnerability in Secomea GateManager (webserver module) allows... |
high | 8.3 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-45048 Open Access Management (OpenAM) is an access management solution. |
high | 8.5 | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-19515 The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate... |
high | 7.0 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-77853 Improper neutralization of special elements used in an OS command ('OS Command I... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-80217 Hidden functionality issue exists in FF-RFI079I4 and FF-RFI078I4, which may allo... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-75092 A privilege escalation flaw was found in the scan_mysql actor of leapp-upgrade-e... |
high | 7.3 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91087 A flaw has been found in GPAC up to f1219cde. |
high | 7.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-75983 The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugi... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-91004 A vulnerability has been found in SourceCodester Online Faculty Clearance System... |
high | 7.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90879 A vulnerability was identified in zyx0814 FilePress up to 3.0.1. |
high | 7.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90880 A security flaw has been discovered in D-Link DSL-3782 2016-07-28. |
high | 7.4 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90858 A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee... |
high | 7.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90876 A vulnerability has been found in SourceCodester Online Faculty Clearance System... |
high | 7.3 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-90877 A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. |
high | 7.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90852 A vulnerability has been found in luben zstd-jni up to 1.5.7-13. |
high | 7.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90854 A security flaw has been discovered in SourceCodester/katojkalemba Online Food O... |
high | 7.3 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-90855 A weakness has been identified in SourceCodester/katojkalemba Online Food Orderi... |
high | 7.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90856 A security vulnerability has been detected in SourceCodester College Notes Galle... |
high | 7.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-91771 Weights & Biases wandb before 0.29.0 fails to validate the file name from server... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-90849 A security vulnerability has been detected in SourceCodester College Notes Galle... |
high | 7.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90846 A vulnerability has been found in PHPGurukul Daily Expense Tracker System 1.1. |
high | 7.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-91751 Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and new_id para... |
high | 8.3 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91752 GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerabilit... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-90843 A security vulnerability has been detected in SabyasachiRana WebMap up to 8b95fe... |
high | 8.3 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-90844 A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. |
high | 7.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90841 A security flaw has been discovered in PHPGurukul Blood Donor Management System... |
high | 7.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90840 A vulnerability was identified in PHPGurukul Blood Donor Management System 1.0. |
high | 7.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-91200 DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry n... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-91144 ZFile through 5.0.5 fails to validate requested file paths against a share link'... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-91145 Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in p... |
high | 7.1 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-91143 goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT t... |
high | 7.2 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-12756 IBM Business Automation Workflow containers and traditional is vulnerable to an... |
high | 7.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90819 A weakness has been identified in a2aproject a2a-java 1.2.0. |
high | 7.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-86904 A privacy issue was addressed with improved state management. |
high | 7.5 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-86917 A permissions issue was addressed with additional restrictions. |
high | 7.8 | — | Apple / macos | 2026-09-14 | 2026-09-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.