September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-90948 A flaw was found in GIMP's ICO file loader. |
high | 7.8 | — | — | 2026-09-14 | 2026-10-19 |
| CVE-2026-90949 A flaw was found in GIMP's PSP (Paint Shop Pro) file loader. |
high | 7.8 | — | — | 2026-09-14 | 2026-10-16 |
| CVE-2026-90787 A vulnerability was identified in Soarkey StudentManagement up to e08f7f1d5015af... |
high | 7.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-73195 Improper Encoding or Escaping of Output vulnerability in Apache Syncope. |
high | 7.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-73236 Incorrect Authorization vulnerability in Apache Syncope. |
high | 7.5 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90938 LangBot's plugin runtime (pip package langbot_plugin) through 0.4.17 starts a de... |
high | 8.6 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-90929 File Browser versions >= 2.5.0 and <= 2.63.23 contain an incorrect authorization... |
high | 8.1 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-90932 LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerabilit... |
high | 7.2 | — | — | 2026-09-14 | 2026-10-29 |
| CVE-2026-90933 laradashboard through 1.2.2 contains a missing authorization vulnerability in th... |
high | 7.1 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-90715 A security vulnerability has been detected in marcobambini Gravity up to 0.9.7. |
high | 7.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-78336 Insertion of sensitive information into sent data vulnerability in Apache Syncop... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-73178 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apac... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2024-58383 Froxlor before 2.2.0 (affected up to and including 2.2.0-rc3) generates /etc/pur... |
high | 7.3 | — | — | 2026-09-14 | 2026-10-27 |
| CVE-2026-90710 A vulnerability was determined in taisan tarzan-cms 1.0.0. |
high | 7.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90707 A security flaw has been discovered in Open5GS up to 2.7.x. |
high | 8.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90708 A weakness has been identified in Yot CMS up to 3.3.1. |
high | 7.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-8821 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.... |
high | 7.1 | — | Mattermost / mattermost server | 2026-09-14 | 2026-10-07 |
| CVE-2026-87779 Insertion of sensitive information into log file vulnerability in Apache Syncope... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-89180 EFence developed by Thinking Software Technology has a SQL Injection vulnerabili... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-90894 Parallels Desktop runs prl_disp_service as root. |
high | 7.8 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-90701 A vulnerability was detected in subhajitkhan online-clinic-management-system up... |
high | 7.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-72524 Incorrect Authorization vulnerability in Apache Doris allows an authenticated us... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90691 A security vulnerability has been detected in 0x4m4 HexStrike AI up to d689933ff... |
high | 8.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90689 A security flaw has been discovered in Tenda W20E 15.11.0.61068_1546_841_CN_TDC. |
high | 8.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90690 A weakness has been identified in 0x4m4 HexStrike AI up to d689933ff579d839c676c... |
high | 7.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82791 Improper neutralization of special elements used in an OS command ('OS Command I... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82793 Unrestricted upload of file with dangerous type issue exists in Contec CAN 2.0B... |
high | 7.2 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82794 SolarView Compact contains an OS command Injection vulnerability in in Schedule... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82789 An improper neutralization of directives in dynamically evaluated code ('Eval In... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82777 Improper neutralization of special elements used in an OS command ('OS Command I... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82779 Improper neutralization of special elements used in an OS command ('OS Command I... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82780 Unrestricted upload of file with dangerous type issue exists in CONPROSYS TM Ser... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82770 Buffer overflow vulnerability exists in Contec RP-WAH-SR Series. |
high | 8.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82772 Buffer overflow vulnerability exists in Contec EC1000 series. |
high | 8.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82774 Improper neutralization of special elements used in an OS command ('OS Command I... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82762 Improper neutralization of special elements used in an OS command ('OS Command I... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82765 Path traversal vulnerability exists in Contec FX5000 series, FX4000 series, and... |
high | 8.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82766 Improper neutralization of special elements used in an OS command ('OS Command I... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82768 Path traversal vulnerability exists in SGA1000. |
high | 8.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-68955 The installer for Rakuten Kobo Desktop Application (Windows version) insecurely... |
high | 7.8 | — | — | 2026-09-14 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.