September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-89013 Dolibarr 23.0.4 before 24.0.1 contains an authorization bypass vulnerability tha... |
high | 7.5 | — | — | 2026-09-11 | 2026-09-23 |
| CVE-2026-7863 Improper neutralization of special elements used in an OS command ('OS command i... |
high | 8.4 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-70341 Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker... |
high | 8.8 | — | Microsoft / edge | 2026-09-11 | 2026-10-28 |
| CVE-2026-68497 jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.x... |
high | 7.5 | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-8301 Improper neutralization of special elements used in an OS command ('OS command i... |
high | 7.8 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-8303 Incorrect privilege assignment vulnerability in TUBITAK BILGEM Software Technolo... |
high | 7.8 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-82578 When XML batch processing is turned on and the XPath option is selected, the raw... |
high | 7.5 | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-82583 NextGen Connect (Mirth Connect) versions 4.7.1 and earlier allow an authenticate... |
high | 8.3 | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-87020 An integer overflow in a specified pitch and buffer-size computation leads to a... |
high | 8.1 | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-78224 The XSLT Transformer Step builds a bare TransformerFactory without the proper se... |
high | 8.2 | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-38056 A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT term... |
high | 8.8 | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-38058 The endpoint on the iDirect iQ200 VSAT terminal returns the complete device conf... |
high | 8.1 | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-89212 A flaw resulting in XML external entity (XXE) was found in Akana API Platform in... |
high | 8.6 | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-71416 Headroom compresses data before the data reaches a large language model. |
high | 8.8 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-71641 An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e... |
high | 7.5 | — | — | 2026-09-11 | 2026-09-22 |
| CVE-2026-57842 NetBSD contains a use-after-free and double-free vulnerability in msg_recv_copyi... |
high | 7.0 | — | — | 2026-09-11 | 2026-09-24 |
| CVE-2026-89256 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored... |
high | 8.7 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89250 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an... |
high | 7.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89253 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a s... |
high | 8.7 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89254 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored... |
high | 8.7 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89255 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored... |
high | 8.7 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89249 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored... |
high | 8.7 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89242 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a s... |
high | 7.2 | — | — | 2026-09-11 | 2026-09-15 |
| CVE-2026-89243 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a s... |
high | 8.1 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-87776 compression is a Node.js and Express compression middleware. |
high | 7.5 | — | — | 2026-09-11 | 2026-09-16 |
| CVE-2026-89147 Net-SNMP through 5.9.5.2 contains a denial of service vulnerability in the SMUX... |
high | 7.5 | — | — | 2026-09-11 | 2026-09-24 |
| CVE-2026-89146 libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in di... |
high | 7.5 | — | — | 2026-09-11 | 2026-09-23 |
| CVE-2026-17037 The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordP... |
high | 7.2 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-80469 An attacker may achieve arbitrary code execution on a target system by uploading... |
high | 8.3 | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-89174 Smart Video Intercom System developed by Kingdom Communication Associated has a... |
high | 7.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89176 WeenyGenius, a computer lab management system developed by Howyar Technologies,... |
high | 8.8 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89177 WeenyGenius, a computer lab management system by Howyar Technologies, has a Use... |
high | 8.8 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89178 WeenyGenius, a computer lab management system by Howyar Technologies, has an Ori... |
high | 8.8 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-85677 The Gutenverse News WordPress plugin before 3.3.3 does not restrict the extra HT... |
high | 8.8 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-87908 multiparty is a Node.js library for parsing multipart/form-data request bodies. |
high | 7.5 | — | — | 2026-09-11 | 2026-09-16 |
| CVE-2026-73784 A potential security vulnerability in HPE IceWall products could be exploited to... |
high | 8.8 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-73785 A potential security vulnerability in HPE IceWall Federation Agent and Proxy cou... |
high | 7.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-74925 The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update... |
high | 7.2 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89060 A cross-namespace authorization flaw in multicluster-observability-addon allows... |
high | 7.7 | — | — | 2026-09-11 | 2026-09-21 |
| CVE-2026-89161 In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject be... |
high | 7.8 | — | Pcre / pcre2 | 2026-09-11 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.