September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2025-55787 In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerabili... |
critical | 9.8 | — | — | 2026-09-17 | 2026-10-26 |
| CVE-2026-54627 SAIL is a cross-platform library for loading and saving images with support for... |
critical | 9.8 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-54752 NetBox Device Type Library is a collection of community-sourced device type defi... |
critical | 9.6 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54618 Obsidian Web MCP is a secure remote MCP server for Obsidian vaults. |
critical | 9.4 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-54626 SAIL is a cross-platform library for loading and saving images with support for... |
critical | 9.8 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54617 GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. |
critical | 9.8 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-47252 Anyquery is an SQL query engine built on top of SQLite. |
critical | 9.0 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-54053 Many Notes is a Markdown note-taking web application designed for simplicity. |
critical | 9.6 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-92489 In the Linux kernel, the following vulnerability has been resolved:
xfrm: Fix s... |
critical | 9.8 | — | — | 2026-09-17 | 2026-10-19 |
| CVE-2026-90413 In the Linux kernel, the following vulnerability has been resolved:
IB/isert: r... |
critical | 9.1 | — | — | 2026-09-17 | 2026-10-19 |
| CVE-2026-90414 In the Linux kernel, the following vulnerability has been resolved:
IB/isert: r... |
critical | 9.1 | — | — | 2026-09-17 | 2026-10-19 |
| CVE-2026-90235 In the Linux kernel, the following vulnerability has been resolved:
sunrpc: xpr... |
critical | 9.8 | — | — | 2026-09-17 | 2026-10-19 |
| CVE-2026-90230 In the Linux kernel, the following vulnerability has been resolved:
nvmet: fix... |
critical | 9.1 | — | — | 2026-09-17 | 2026-10-19 |
| CVE-2026-90173 In the Linux kernel, the following vulnerability has been resolved:
smb: smbdir... |
critical | 9.8 | — | — | 2026-09-17 | 2026-10-19 |
| CVE-2026-90151 In the Linux kernel, the following vulnerability has been resolved:
NFSv4: remo... |
critical | 9.8 | — | — | 2026-09-17 | 2026-10-19 |
| CVE-2026-90104 In the Linux kernel, the following vulnerability has been resolved:
NFSv4.1: ze... |
critical | 9.8 | — | — | 2026-09-17 | 2026-10-21 |
| CVE-2026-90110 In the Linux kernel, the following vulnerability has been resolved:
inetpeer: r... |
critical | 9.4 | — | — | 2026-09-17 | 2026-10-19 |
| CVE-2026-86863 pgAdmin 4's Webserver authentication source is intended to accept an identity as... |
critical | 9.8 | — | Pgadmin / pgadmin 4 | 2026-09-17 | 2026-09-21 |
| CVE-2026-63472 Vendure is an open-source headless commerce platform. |
critical | 9.1 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92960 vm2 before 3.11.6 fails to restrict access to os and dns builtins under the buil... |
critical | 10.0 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92953 vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and Array... |
critical | 10.0 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-92955 vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows... |
critical | 10.0 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92956 vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a def... |
critical | 10.0 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92957 vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when e... |
critical | 9.9 | — | — | 2026-09-17 | 2026-09-26 |
| CVE-2026-92947 vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing... |
critical | 10.0 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92948 vm2 versions >= 3.9.6 and <= 3.11.6 are affected by a NodeVM builtin allowlist b... |
critical | 9.9 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-92951 vm2 before 3.11.7 contains an incorrect authorization vulnerability in the exter... |
critical | 9.9 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92940 vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAg... |
critical | 10.0 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92941 vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sand... |
critical | 10.0 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92944 vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Nod... |
critical | 9.8 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-92946 vm2 before 3.11.7 contains a remote code execution vulnerability when require.ex... |
critical | 10.0 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92937 vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in... |
critical | 10.0 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-92938 vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to c... |
critical | 9.9 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-92939 vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM san... |
critical | 9.9 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92934 vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that a... |
critical | 9.0 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92935 vm2 is a sandbox for running untrusted Node.js code. |
critical | 9.0 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-62104 Unauthenticated Remote Code Execution (RCE) in Migratico Lite <= 2.6.8 versions. |
critical | 10.0 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-62108 Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versio... |
critical | 9.8 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-62101 Unauthenticated Broken Authentication in EduAdmin Booking <= 5.4.2 versions. |
critical | 9.8 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92860 A security flaw has been discovered in rcourtman Pulse up to 6.0.4/6.1.0-rc.4. |
critical | 9.1 | — | — | 2026-09-17 | 2026-09-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.