September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87011 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
high | 7.5 | — | Openwebui / open webui | 2026-09-09 | 2026-09-15 |
| CVE-2026-71808 A SQL Injection vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote... |
high | 8.8 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-79324 Missing authorization in the Address Delete controller in Mageplaza GDPR for Mag... |
high | 7.5 | — | Mageplaza / gdpr | 2026-09-09 | 2026-09-10 |
| CVE-2026-73769 A vulnerability in the web-based management interface of vulnerable CPPM systems... |
high | 7.2 | — | — | 2026-09-09 | 2026-09-11 |
| CVE-2026-73786 A vulnerability in the web-based management interface of CPPM could allow an una... |
high | 7.5 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-73787 A vulnerability in the CPPM web interface could allow an authenticated remote at... |
high | 7.2 | — | — | 2026-09-09 | 2026-09-11 |
| CVE-2026-71612 Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 a... |
high | 8.4 | — | — | 2026-09-09 | 2026-09-14 |
| CVE-2026-71613 Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 a... |
high | 7.8 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-71614 An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to... |
high | 8.4 | — | — | 2026-09-09 | 2026-09-14 |
| CVE-2026-61915 An issue was discovered in Cyrus IMAP before 3.12.4. |
high | 7.1 | — | Cyrus / imap | 2026-09-09 | 2026-09-16 |
| CVE-2026-79323 Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL... |
high | 7.5 | — | Mageplaza / magefan blog | 2026-09-09 | 2026-09-10 |
| CVE-2026-79322 SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 (magep... |
high | 8.6 | — | Mageplaza / mageplaza blog | 2026-09-09 | 2026-09-10 |
| CVE-2026-52482 An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attack... |
high | 7.5 | — | — | 2026-09-09 | 2026-09-14 |
| CVE-2026-87874 A flaw was found in the memcached cache plugin of the community.general Ansible... |
high | 8.1 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-87927 MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the a... |
high | 8.2 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-87930 MaxSite CMS through 109.6 passes the ci_session cookie to unserialize() without... |
high | 8.1 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-87853 A flaw was found in SSSD's IdP authentication provider. |
high | 7.5 | — | — | 2026-09-09 | 2026-10-29 |
| CVE-2026-80921 In the Linux kernel, the following vulnerability has been resolved:
KVM: s390:... |
high | 8.8 | — | — | 2026-09-09 | 2026-10-19 |
| CVE-2026-80924 In the Linux kernel, the following vulnerability has been resolved:
crypto: krb... |
high | 7.5 | — | — | 2026-09-09 | 2026-10-19 |
| CVE-2026-80914 In the Linux kernel, the following vulnerability has been resolved:
Bluetooth:... |
high | 8.8 | — | — | 2026-09-09 | 2026-10-19 |
| CVE-2026-23855 Dell iDRAC9, 14G versions prior to 7.00.00.184, 15G/16G versions prior to 7.30.1... |
high | 7.2 | — | — | 2026-09-09 | 2026-09-11 |
| CVE-2026-18147 A flaw was found in FreeIPA. |
high | 8.1 | — | — | 2026-09-09 | 2026-10-26 |
| CVE-2026-82563 An attacker could impersonate the camera and place themselves in a man-in-the-mi... |
high | 7.6 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-81640 An attacker could derive the camera's Wi-Fi password and connect to its wireless... |
high | 8.8 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-77974 After spoofing the device and obtaining one user confirmation, an attacker may b... |
high | 8.0 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-78484 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.8 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-11 |
| CVE-2026-78493 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.8 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-11 |
| CVE-2026-22591 eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service)... |
high | 7.5 | — | — | 2026-09-09 | 2026-09-14 |
| CVE-2026-87877 zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setL... |
high | 7.7 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-87822 t-digest versions 3.1 through 3.3 fail to validate centroid means during deseria... |
high | 7.5 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-87823 zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-By... |
high | 8.2 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-87824 zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.t... |
high | 7.5 | — | — | 2026-09-09 | 2026-09-20 |
| CVE-2026-87825 zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams a... |
high | 7.7 | — | — | 2026-09-09 | 2026-09-14 |
| CVE-2026-79617 Incorrect Permission Assignment for Critical Resource vulnerability in TÜBİTAK B... |
high | 7.1 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-78482 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.8 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-26212 Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitra... |
high | 7.2 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-86775 knowns (npm package) versions <= 0.29.1 contain a path traversal vulnerability i... |
high | 8.6 | — | — | 2026-09-09 | 2026-09-14 |
| CVE-2026-86770 Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML au... |
high | 8.1 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-86771 Snipe-IT versions before 8.7.0 fail to HTML-escape the employee_num field in the... |
high | 7.6 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-86762 Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the... |
high | 8.1 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.