September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86404 EAP's Artemis deserialization configuration permits deserialization by default. |
high | 8.8 | — | — | 2026-09-07 | 2026-10-20 |
| CVE-2026-86295 A vulnerability was found in D-Link DIR-895L A1_102b07. |
high | 8.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86297 A vulnerability was identified in D-Link DIR-605 B1v202WWB03. |
high | 8.1 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86298 A security flaw has been discovered in SourceCodester Class and Exam Timetabling... |
high | 7.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86292 A vulnerability was detected in SourceCodester Simple Traffic Offense System 1.0... |
high | 7.3 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86290 A weakness has been identified in SourceCodester Online Voting System 1.0. |
high | 7.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86282 A weakness has been identified in jaychouchannel Tourism-Management-System up to... |
high | 7.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-78254 The ftp and scp tasks of Apache Ant can download files from a remote server. |
high | 7.4 | — | Apache / ant | 2026-09-07 | 2026-09-09 |
| CVE-2026-14296 When using the Direct XIP
update strategy, the main application image starts oth... |
high | 7.5 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86277 A vulnerability has been found in SourceCodester Syllabus-Aligned Learning Manag... |
high | 7.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86276 A flaw has been found in SourceCodester Syllabus-Aligned Learning Management & E... |
high | 7.3 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86273 A weakness has been identified in projeto-siga siga up to 11.1.1. |
high | 7.3 | — | — | 2026-09-07 | 2026-09-11 |
| CVE-2026-86272 A vulnerability was determined in Beijing Meite Software Technology U+Smart Enjo... |
high | 7.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86268 A vulnerability was detected in itsourcecode School Management System 1.0. |
high | 7.3 | — | — | 2026-09-07 | 2026-09-28 |
| CVE-2026-86263 A vulnerability was detected in sfturing hosp_order up to 627f426331da8086ce8fff... |
high | 7.3 | — | — | 2026-09-07 | 2026-09-28 |
| CVE-2026-86313 Out-of-bounds write vulnerability in Samsung Opensource Walrus allows Overflow B... |
high | 7.8 | — | — | 2026-09-07 | 2026-09-28 |
| CVE-2026-86261 A weakness has been identified in sfturing hosp_order up to 627f426331da8086ce8f... |
high | 7.3 | — | — | 2026-09-07 | 2026-09-28 |
| CVE-2026-86262 A security vulnerability has been detected in sfturing hosp_order up to 627f4263... |
high | 7.3 | — | — | 2026-09-07 | 2026-09-28 |
| CVE-2026-20501 In vdec, there is a possible out of bounds write due to a heap buffer overflow. |
high | 8.4 | — | Mediatek / mt2718 firmware | 2026-09-07 | 2026-09-09 |
| CVE-2026-20502 In vdec, there is a possible out of bounds write due to a missing bounds check. |
high | 8.4 | — | Mediatek / mt2718 firmware | 2026-09-07 | 2026-09-09 |
| CVE-2026-86225 A vulnerability was identified in SourceCodester Class and Exam Timetabling Syst... |
high | 7.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86224 A vulnerability was determined in SourceCodester Class and Exam Timetabling Syst... |
high | 7.3 | — | — | 2026-09-06 | 2026-09-11 |
| CVE-2026-86222 A vulnerability has been found in SourceCodester Class and Exam Timetabling Syst... |
high | 7.3 | — | — | 2026-09-06 | 2026-09-09 |
| CVE-2026-86223 A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.... |
high | 7.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86221 A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. |
high | 7.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86220 A vulnerability was detected in SourceCodester Class and Exam Timetabling System... |
high | 7.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-80229 When performing transfers via libcurl’s multi interface, pooled TLS
connections... |
high | 7.5 | — | Haxx / curl | 2026-09-06 | 2026-09-15 |
| CVE-2026-80230 When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable
stan... |
high | 7.5 | — | Haxx / curl | 2026-09-06 | 2026-09-15 |
| CVE-2026-80231 A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup
for... |
high | 7.5 | — | Haxx / curl | 2026-09-06 | 2026-09-15 |
| CVE-2026-80255 A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of
space... |
high | 7.5 | — | Haxx / curl | 2026-09-06 | 2026-09-15 |
| CVE-2026-82208 With the wolfSSL backend, when CA caching is enabled and an
`CURLOPT_SSL_CTX_FUN... |
high | 7.5 | — | Haxx / curl | 2026-09-06 | 2026-09-15 |
| CVE-2026-82209 When libpsl support is enabled, libcurl fails to enforce the Public Suffix
List... |
high | 8.2 | — | Haxx / curl | 2026-09-06 | 2026-09-15 |
| CVE-2026-13608 A flaw in the libcurl SASL negotiation for LDAP authentication allows an
incompl... |
high | 7.4 | — | Haxx / curl | 2026-09-06 | 2026-09-15 |
| CVE-2026-19633 PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked u... |
high | 8.8 | — | — | 2026-09-06 | 2026-09-09 |
| CVE-2026-86213 A vulnerability was found in Mstfakts College-Management-System. |
high | 7.3 | — | — | 2026-09-06 | 2026-09-10 |
| CVE-2026-86214 A vulnerability was determined in Mstfakts College-Management-System. |
high | 7.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86259 OpenMAIC before 1.0.1 skips server-side request forgery validation in non-produc... |
high | 7.5 | — | — | 2026-09-06 | 2026-09-10 |
| CVE-2022-51009 PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore... |
high | 7.5 | — | — | 2026-09-06 | 2026-10-08 |
| CVE-2026-86242 Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path... |
high | 8.1 | — | — | 2026-09-06 | 2026-09-09 |
| CVE-2026-86250 h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user... |
high | 7.5 | — | — | 2026-09-06 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.