September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-55091 flat-to-nested converts a hierarchy from a flat representation to a nested repre... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54180 backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpa... |
high | 7.6 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54182 backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpa... |
high | 8.1 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54567 Flask-Reuploaded provides file uploads for Flask. |
high | 7.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54175 backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpa... |
high | 7.6 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54178 backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpa... |
high | 8.1 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-53659 http4k is a functional toolkit for Kotlin HTTP applications. |
high | 7.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-53752 docx4j is an open source Java library for creating, editing, and saving OpenXML... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54087 EasyAdmin is a fast and modern admin generator for Symfony applications. |
high | 7.6 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-50270 dd-trace-java is a Datadog APM client for Java. |
high | 7.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-50276 dd-trace-rb is Datadog's client library for Ruby. |
high | 7.5 | — | — | 2026-09-14 | 2026-09-25 |
| CVE-2026-19499 Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can writ... |
high | 7.7 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-76442 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-57579 Alchemy is an open source content management system engine written in Ruby on Ra... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-59960 Argos JavaScript provides official Argos SDKs for JavaScript. |
high | 7.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-61701 Laravel MagicLink creates links for authentication without a password or for acc... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-55416 Pimcore is an Open Source Data & Experience Management Platform. |
high | 8.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-55072 Pimcore is an Open Source Data & Experience Management Platform. |
high | 8.5 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-54155 node-opcua is an OPC UA implementation for TypeScript and Node.js. |
high | 7.7 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54156 node-opcua is an OPC UA implementation for TypeScript and Node.js. |
high | 7.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-90943 parallax filament-comments through 3.0.0 contains a stored cross-site scripting... |
high | 8.7 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-90947 A flaw was found in GIMP. |
high | 7.8 | — | — | 2026-09-14 | 2026-10-19 |
| CVE-2026-57132 PraisonAI is a multi-agent teams system. |
high | 8.2 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-57119 PraisonAI is a multi-agent teams system. |
high | 7.5 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-57122 PraisonAI is a multi-agent teams system. |
high | 8.6 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-56839 PraisonAI is a multi-agent teams system. |
high | 7.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-47701 The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collec... |
high | 7.7 | — | — | 2026-09-14 | 2026-09-25 |
| CVE-2026-90789 A weakness has been identified in itsourcecode Leave Management System 1.0. |
high | 7.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-82432 Description
Nimbus validated `topology.blobstore.map` against the calling subje... |
high | 8.1 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-82438 Description
Three separate mechanisms allowed a web page on an unrelated origin... |
high | 8.1 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-82427 Description
A topology's `topology.blobstore.map` lets the submitter choose a l... |
high | 7.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-82428 Description
Dependency artifacts uploaded with `storm jar --artifacts` were sto... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-82429 Description
The setuid-root `worker-launcher` binary adjusts ownership and perm... |
high | 7.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-82430 Description
When launching a Docker or OCI worker, the setuid-root `worker-laun... |
high | 7.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-57126 PraisonAI is a multi-agent teams system. |
high | 8.5 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-57129 PraisonAI is a multi-agent teams system. |
high | 7.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-57130 PraisonAI is a multi-agent teams system. |
high | 8.1 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-59569 An improper input validation vulnerability in Zscaler Client Connector on Androi... |
high | 8.1 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-59570 On affected versions of Zscaler client connector, a pre-installed peer app can t... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-25687 A race condition in the ZPA tunnel handler of affected versions of Zscaler Clien... |
high | 8.1 | — | — | 2026-09-14 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.