September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-81784 Deserialization of Untrusted Data vulnerability in Marcin Wise Chat wise-chat al... |
high | 8.1 | — | — | 2026-09-10 | 2026-10-06 |
| CVE-2026-46387 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-10 | 2026-09-28 |
| CVE-2026-45747 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-10 | 2026-09-28 |
| CVE-2026-88889 Renovate before 44.14.7 contains a command injection vulnerability in the Maven... |
high | 7.8 | — | — | 2026-09-10 | 2026-09-29 |
| CVE-2026-88890 OpenPanel through 2.3.0 contains an SQL injection vulnerability in the analytics... |
high | 8.5 | — | — | 2026-09-10 | 2026-10-02 |
| CVE-2026-88891 OpenPanel through 2.3.0 fails to enforce read-only project access level on 26 of... |
high | 8.3 | — | — | 2026-09-10 | 2026-10-02 |
| CVE-2026-88893 OpenPanel through 2.3.0 share lookup procedures fail to validate access controls... |
high | 7.5 | — | — | 2026-09-10 | 2026-10-02 |
| CVE-2026-88895 CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoi... |
high | 7.2 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-88885 Renovate before 44.14.7 contains a command injection vulnerability in the gomod... |
high | 7.0 | — | — | 2026-09-10 | 2026-09-29 |
| CVE-2026-88886 Renovate is a dependency update automation tool. |
high | 7.8 | — | — | 2026-09-10 | 2026-09-29 |
| CVE-2026-88887 Renovate is a dependency update automation tool. |
high | 8.6 | — | — | 2026-09-10 | 2026-09-29 |
| CVE-2026-88888 Renovate before 44.14.7 contains a command injection vulnerability in the Mix ma... |
high | 7.0 | — | — | 2026-09-10 | 2026-09-29 |
| CVE-2026-88879 Traefik is an HTTP reverse proxy and load balancer. |
high | 8.2 | — | Traefik / traefik | 2026-09-10 | 2026-10-08 |
| CVE-2026-88880 Renovate before 44.11.3 fails to validate Link header destinations when followin... |
high | 8.6 | — | — | 2026-09-10 | 2026-09-29 |
| CVE-2026-88881 Renovate, a dependency update tool, follows pagination links supplied by the Git... |
high | 8.6 | — | — | 2026-09-10 | 2026-09-29 |
| CVE-2026-88882 Renovate is a dependency update automation tool. |
high | 8.6 | — | — | 2026-09-10 | 2026-09-29 |
| CVE-2026-88883 Renovate is an automated dependency update tool. |
high | 7.7 | — | — | 2026-09-10 | 2026-09-29 |
| CVE-2026-88872 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-... |
high | 7.1 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88873 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a c... |
high | 7.1 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88874 AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-0... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88876 AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a miss... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-15 |
| CVE-2026-88870 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a c... |
high | 7.1 | — | — | 2026-09-10 | 2026-09-18 |
| CVE-2026-88868 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored... |
high | 8.7 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88865 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate... |
high | 8.1 | — | — | 2026-09-10 | 2026-09-18 |
| CVE-2026-88866 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a s... |
high | 8.7 | — | — | 2026-09-10 | 2026-09-15 |
| CVE-2026-88867 WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07... |
high | 8.7 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88861 Capgo (Cap-go/capgo.app) contains an authentication bypass affecting all version... |
high | 8.3 | — | — | 2026-09-10 | 2026-09-30 |
| CVE-2026-88862 Capgo (capgo.app) backend through 12.242.4 does not validate parent-child delega... |
high | 8.8 | — | — | 2026-09-10 | 2026-09-30 |
| CVE-2026-88863 capgo.app (npm package `capgo`) through version 12.207.1 does not compare the ca... |
high | 8.1 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-85217 A maliciously crafted add-in, when installed and executed in Autodesk Fusion Des... |
high | 8.6 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-75584 ION-DTN before 4.2.1-a.1 contains a denial of service vulnerability that allows... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-18 |
| CVE-2026-6285 Weak Password Recovery Mechanism for Forgotten Password vulnerability in Ankaref... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-23 |
| CVE-2026-64836 ICEcoder versions through 8.1 contain a path traversal vulnerability in the file... |
high | 8.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-64837 ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in... |
high | 8.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-64838 ICEcoder versions through 8.1 fail to properly validate the oldFileName paramete... |
high | 8.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-9166 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-85545 There is an Vulnerability in some HikCentral Access Control versions. |
high | 7.1 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-87961 ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds r... |
high | 7.1 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-87962 t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in M... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-87803 An authorization bypass vulnerability exists in the Countly Server DBViewer due... |
high | 7.1 | — | — | 2026-09-10 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.