September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2023-50461 An issue was discovered in the direct_mail (aka Direct Mail) extension through 9... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-45858 A directory traversal was identified in Paessler PRTG before 23.4.88.1429 that m... |
high | 8.6 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-46273 Bonjour Gateway in Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-32803 The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-28148 A bodyclass XSS issue was discovered in Paessler PRTG before 23.3.86.1520. |
high | 7.2 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-90617 A vulnerability was detected in GH05TCREW PentestAgent up to cf882dabea3ed91cef0... |
high | 7.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90618 A flaw has been found in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd11... |
high | 7.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90619 A vulnerability has been found in 0x4m4 HexStrike AI up to d689933ff579d839c676c... |
high | 7.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90620 A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c... |
high | 7.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-31278 An issue in the /api/v2/setting/adserversetting endpoint of Suprema BioStar 2 be... |
high | 7.7 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-33963 An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380,... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-23789 An issue was discovered in MFC in Samsung Mobile Processor and Wearable Processo... |
high | 7.8 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-90601 A vulnerability was found in getzep graphiti up to 0.30.2. |
high | 7.3 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90603 A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.... |
high | 7.3 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-15891 The MQTT-SN client keepalive handler process_ping() in subsys/net/lib/mqtt_sn/mq... |
high | 7.5 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-52296 FFmpeg before 9.0 has an out-of-bounds read because of missing required padding... |
high | 7.1 | — | Ffmpeg / ffmpeg | 2026-09-13 | 2026-10-14 |
| CVE-2026-52297 FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padd... |
high | 7.1 | — | Ffmpeg / ffmpeg | 2026-09-13 | 2026-10-14 |
| CVE-2026-85129 The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or vali... |
high | 8.8 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-88793 The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any author... |
high | 8.8 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-88802 The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events... |
high | 7.5 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90593 A vulnerability was determined in embedded-graphics up to 0.8.2. |
high | 7.3 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-37008 CrewAI before fb2323b offers a Python blocklist approach that operates at the wr... |
high | 8.1 | — | — | 2026-09-13 | 2026-09-22 |
| CVE-2026-74933 The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisatio... |
high | 8.8 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-36453 Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1. |
high | 7.4 | — | — | 2026-09-13 | 2026-09-22 |
| CVE-2026-29811 CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second dom... |
high | 7.7 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90579 A vulnerability has been found in cheshire-cat-ai Cheshire Cat AI up to 1.9.2. |
high | 7.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90566 A weakness has been identified in Rizwan17 inventory-management-system up to bfe... |
high | 7.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90524 A security flaw has been discovered in jaychouchannel Tourism-Management-System... |
high | 7.3 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90526 A security vulnerability has been detected in SourceCodester School Registration... |
high | 7.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90523 A vulnerability was identified in jaychouchannel Tourism-Management-System up to... |
high | 7.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90522 A vulnerability was determined in jaychouchannel Tourism-Management-System up to... |
high | 7.3 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90783 MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib l... |
high | 7.8 | — | — | 2026-09-13 | 2026-09-30 |
| CVE-2026-90780 SIPp through 3.7.7 contains a buffer overflow vulnerability in the get_header()... |
high | 7.5 | — | — | 2026-09-13 | 2026-09-23 |
| CVE-2026-90776 Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vul... |
high | 7.5 | — | — | 2026-09-13 | 2026-09-24 |
| CVE-2026-90777 ESPnet before 202609 deserializes pretrained model checkpoints using torch.load... |
high | 8.8 | — | — | 2026-09-13 | 2026-09-23 |
| CVE-2026-90778 SIPp through 3.7.7 contains a buffer overflow vulnerability in get_peer_tag() fu... |
high | 7.5 | — | — | 2026-09-13 | 2026-09-23 |
| CVE-2026-90779 SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthH... |
high | 7.5 | — | — | 2026-09-13 | 2026-09-23 |
| CVE-2026-90515 A vulnerability was determined in SourceCodester School Registration and Fee Sys... |
high | 7.3 | — | — | 2026-09-13 | 2026-09-20 |
| CVE-2026-90516 A vulnerability was found in SourceCodester School Registration and Fee System 1... |
high | 7.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90774 rustypaste before 0.18.1 validates the destination path before applying the opti... |
high | 7.5 | — | — | 2026-09-13 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.