September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-78569 IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to e... |
high | 8.8 | — | Langflow / langflow | 2026-09-10 | 2026-09-16 |
| CVE-2026-78571 IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-09-10 | 2026-09-16 |
| CVE-2026-71643 An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-22 |
| CVE-2026-45770 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-10 | 2026-09-16 |
| CVE-2026-45762 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-10 | 2026-09-28 |
| CVE-2026-45765 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-10 | 2026-09-16 |
| CVE-2026-45766 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-10 | 2026-09-16 |
| CVE-2026-45768 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-10 | 2026-09-16 |
| CVE-2026-45769 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-10 | 2026-09-16 |
| CVE-2026-2310 IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable... |
high | 7.8 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2025-57231 Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticate... |
high | 7.5 | — | — | 2026-09-10 | 2026-10-26 |
| CVE-2026-9176 IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass... |
high | 7.1 | — | Ibm / websphere application server | 2026-09-10 | 2026-09-15 |
| CVE-2026-9327 IBM WebSphere Application Server 9.0, and 8.5 could allow an authenticated user... |
high | 8.1 | — | Ibm / websphere application server | 2026-09-10 | 2026-09-15 |
| CVE-2026-79592 An out-of-bounds read vulnerability exists in the xls_dumpSummary() function of... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-22 |
| CVE-2026-79591 A heap-buffer-overflow and use-after-free vulnerability exists in the xls_getCSS... |
high | 7.8 | — | — | 2026-09-10 | 2026-09-22 |
| CVE-2026-63427 An authentication bypass vulnerability was discovered in Lenovo Software Fix tha... |
high | 7.8 | — | — | 2026-09-10 | 2026-09-15 |
| CVE-2026-45751 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-10 | 2026-09-28 |
| CVE-2026-45759 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-10 | 2026-09-16 |
| CVE-2026-18994 A potential improper authorization vulnerability was reported in the Lenovo File... |
high | 7.1 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-19136 A potential command injection vulnerability was reported in the Tianxi AI Agent... |
high | 7.8 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-11813 A potential improper permissions vulnerability was reported in the Lenovo Filez... |
high | 7.8 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-89087 The cstruct package before 6.3.0 for OCaml mishandles indexes. |
high | 7.3 | — | — | 2026-09-10 | 2026-09-22 |
| CVE-2026-89011 isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the... |
high | 7.1 | — | — | 2026-09-10 | 2026-09-23 |
| CVE-2026-89054 A missing authorization vulnerability in OpenNMS Horizon allows configuration ch... |
high | 8.2 | — | — | 2026-09-10 | 2026-09-18 |
| CVE-2026-9336 IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of servi... |
high | 7.5 | — | Ibm / websphere application server | 2026-09-10 | 2026-09-16 |
| CVE-2026-88036 Improper neutralization of special elements in data query logic in the GridFS co... |
high | 8.3 | — | Mongodb / c driver | 2026-09-10 | 2026-09-16 |
| CVE-2026-88032 A use-after-free in the reactive client-side encryption component of the MongoDB... |
high | 7.5 | — | Mongodb / java driver | 2026-09-10 | 2026-09-16 |
| CVE-2026-88033 Improper neutralization of special elements in data query logic in the GridFS co... |
high | 8.3 | — | Mongodb / java driver | 2026-09-10 | 2026-09-16 |
| CVE-2026-88034 Improper neutralization of special elements in data query logic in the GridFS co... |
high | 8.3 | — | Mongodb / c\+\+ driver | 2026-09-10 | 2026-09-16 |
| CVE-2026-87993 The consul-template library is vulnerable to an information disclosure issue in... |
high | 7.7 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88021 Consul and Consul Enterprise are vulnerable to an authorization bypass in the Co... |
high | 7.1 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-87090 Consul and Consul Enterprise are vulnerable to an authorization bypass in the ca... |
high | 8.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-89043 passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulner... |
high | 7.4 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-89046 zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnera... |
high | 8.2 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88051 Tesseract is an open source OCR engine. |
high | 7.8 | — | Tesseract-ocr / tesseract ocr | 2026-09-10 | 2026-09-16 |
| CVE-2026-88052 Tesseract is an open source OCR engine. |
high | 7.8 | — | Tesseract-ocr / tesseract ocr | 2026-09-10 | 2026-09-16 |
| CVE-2026-88053 Tesseract is an open source OCR engine. |
high | 7.8 | — | Tesseract-ocr / tesseract ocr | 2026-09-10 | 2026-09-16 |
| CVE-2026-88027 Improper neutralization of special elements in data query logic in the embedded-... |
high | 8.1 | — | Mongodb / laravel mongodb | 2026-09-10 | 2026-09-29 |
| CVE-2026-88029 Improper neutralization of special elements in data query logic in the GridFS co... |
high | 8.3 | — | Mongodb / python driver | 2026-09-10 | 2026-09-29 |
| CVE-2026-88030 Improper neutralization of special elements in data query logic in the GridFS co... |
high | 8.3 | — | Mongodb / ruby driver | 2026-09-10 | 2026-09-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.