September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-89157 PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-boun... |
high | 7.4 | — | Pcre / pcre2 | 2026-09-11 | 2026-09-16 |
| CVE-2026-81754 The Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner…... |
high | 7.2 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-81825 The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulne... |
high | 7.2 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-19991 The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in ver... |
high | 8.1 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-18579 The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site... |
high | 7.2 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-15462 The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via t... |
high | 7.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-18561 The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL I... |
high | 7.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-78135 libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in th... |
high | 7.3 | — | Strongswan / strongswan | 2026-09-11 | 2026-09-16 |
| CVE-2026-78130 strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin... |
high | 7.5 | — | Strongswan / strongswan | 2026-09-11 | 2026-09-15 |
| CVE-2026-78132 strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribu... |
high | 7.5 | — | Strongswan / strongswan | 2026-09-11 | 2026-09-14 |
| CVE-2026-78133 libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeyi... |
high | 7.5 | — | Strongswan / strongswan | 2026-09-11 | 2026-09-14 |
| CVE-2026-78134 strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and... |
high | 7.1 | — | Strongswan / strongswan | 2026-09-11 | 2026-09-14 |
| CVE-2026-77807 The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution... |
high | 7.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-84889 IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-09-10 | 2026-09-14 |
| CVE-2026-86093 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker... |
high | 7.5 | — | Ibm / db2 | 2026-09-10 | 2026-09-14 |
| CVE-2026-87958 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a deni... |
high | 8.1 | — | Ibm / db2 | 2026-09-10 | 2026-09-14 |
| CVE-2026-81940 IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-09-10 | 2026-09-16 |
| CVE-2026-81941 IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative... |
high | 8.8 | — | Langflow / langflow | 2026-09-10 | 2026-09-16 |
| CVE-2026-82095 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-82097 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-82098 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-82099 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-81213 IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to obtain se... |
high | 8.6 | — | Langflow / langflow | 2026-09-10 | 2026-09-16 |
| CVE-2026-81265 IBM Langflow OSS 1.0.0 through 1.11.5. |
high | 7.5 | — | Langflow / langflow | 2026-09-10 | 2026-09-16 |
| CVE-2026-81268 IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacke... |
high | 8.1 | — | Langflow / langflow | 2026-09-10 | 2026-09-16 |
| CVE-2026-81540 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.5 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-81550 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-81551 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.1 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-80380 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote attacker to per... |
high | 7.1 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-80436 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.5 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-81207 IBM DataStage on Cloud Pak for Data 5.4.0.0 allows any authenticated tenant — wi... |
high | 8.5 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-81210 IBM DataStage on Cloud Pak for Data 5.4.0.0 concatenates three caller-supplied s... |
high | 7.7 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-81211 IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-09-10 | 2026-09-16 |
| CVE-2026-78575 IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-09-10 | 2026-09-16 |
| CVE-2026-79742 IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-09-10 | 2026-09-16 |
| CVE-2026-71645 An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: c... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-22 |
| CVE-2026-71647 An issue in EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567ab... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-22 |
| CVE-2026-75624 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.... |
high | 8.8 | — | Ibm / app connect enterprise | 2026-09-10 | 2026-09-16 |
| CVE-2026-75777 IBM Aspera Enterprise WebApps 1.0.0 through 1.0.5 could allow a local attacker t... |
high | 8.8 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-76059 IBM Langflow OSS 1.0.0 through 1.11.5 An attacker who could submit custom compon... |
high | 8.8 | — | Langflow / langflow | 2026-09-10 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.