September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-80114 PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 10... |
high | 7.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-80116 PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 10... |
high | 7.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-80117 PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 10... |
high | 7.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-80118 PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 10... |
high | 7.1 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-80119 PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 10... |
high | 7.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-78839 An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers... |
high | 8.1 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-80112 PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 10... |
high | 7.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-80113 PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 10... |
high | 7.1 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-71620 File Upload vulnerability in Zhao-github ApiAdmin v.5.0.1 allows a remote attack... |
high | 8.1 | — | — | 2026-09-04 | 2026-09-14 |
| CVE-2026-9317 Nango before 0.71.6 contains a missing authentication vulnerability in the runne... |
high | 8.1 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-85656 An OS command injection issue in the log4j-cve-2021-44228-hotpatch package in Am... |
high | 7.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85654 Improper neutralization of special elements used in a template engine in the CDK... |
high | 7.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-82538 ILIAS before versions 9.22, 10.10, and 11.3 contains a SQL injection vulnerabili... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-30 |
| CVE-2026-61686 SolidInvoice is an open-source invoicing platform. |
high | 7.5 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-57161 PJSIP is a free and open source multimedia communication library written in C. |
high | 8.2 | — | Teluu / pjsip | 2026-09-04 | 2026-09-11 |
| CVE-2026-57159 PJSIP is a free and open source multimedia communication library written in C. |
high | 7.5 | — | Teluu / pjsip | 2026-09-04 | 2026-09-11 |
| CVE-2026-19534 undici's WebSocket client crashes the whole Node.js process during the opening h... |
high | 7.5 | — | Nodejs / undici | 2026-09-04 | 2026-09-16 |
| CVE-2021-44320 Parrot AR.Drone version 1 and 2 does not employ a suitable mechanism to prevent... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2021-44319 Parrot AR.Drone 1 and AR.Drone 2 are vulnerable to Denial of Service. |
high | 7.5 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-85014 undici's experimental WebSocketStream client crashes the whole Node.js process w... |
high | 7.5 | — | Nodejs / undici | 2026-09-04 | 2026-09-15 |
| CVE-2026-85152 undici 8.10.0 omits the destination origin from the cache and request-deduplicat... |
high | 7.4 | — | Nodejs / undici | 2026-09-04 | 2026-09-16 |
| CVE-2026-84933 undici's cache interceptor does not handle the Set-Cookie response header anywhe... |
high | 8.2 | — | Nodejs / undici | 2026-09-04 | 2026-09-15 |
| CVE-2026-18175 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to manipulate databas... |
high | 7.5 | — | Ibm / i | 2026-09-04 | 2026-09-10 |
| CVE-2026-18341 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to corr... |
high | 8.8 | — | Ibm / i | 2026-09-04 | 2026-09-08 |
| CVE-2026-18486 IBM ContextForge MCP Gateway <= v1.0.7 MCP Context Forge could allow a remote au... |
high | 8.8 | — | Ibm / contextforge | 2026-09-04 | 2026-09-15 |
| CVE-2026-18489 IBM ContextForge MCP Gateway - Translate utility <= 1.0.8 MCP Context Forge coul... |
high | 7.4 | — | Ibm / contextforge | 2026-09-04 | 2026-09-15 |
| CVE-2026-17627 IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacke... |
high | 7.1 | — | Langflow / langflow | 2026-09-04 | 2026-09-09 |
| CVE-2026-17470 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of... |
high | 7.5 | — | Ibm / i | 2026-09-04 | 2026-09-09 |
| CVE-2026-17499 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary c... |
high | 7.8 | — | Ibm / i | 2026-09-04 | 2026-09-09 |
| CVE-2026-17255 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of... |
high | 7.5 | — | Ibm / i | 2026-09-04 | 2026-09-10 |
| CVE-2026-16826 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary c... |
high | 7.8 | — | Ibm / i | 2026-09-04 | 2026-09-10 |
| CVE-2026-13297 IBM Verify Identity Access Advanced Access Control may be vulnerable to an infor... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-79418 EMX Tecnologia Gestao X version <= 8.4 contains a Stored Cross-Site Scripting (X... |
high | 8.7 | — | Emxtecnologia / gestao x business suite | 2026-09-04 | 2026-09-17 |
| CVE-2026-79419 A reflected cross-site scripting (XSS) vulnerability exists in EMX Tecnologia Ge... |
high | 8.7 | — | Emxtecnologia / gestao x business suite | 2026-09-04 | 2026-09-17 |
| CVE-2026-78543 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.... |
high | 7.5 | — | Ibm / app connect enterprise | 2026-09-04 | 2026-09-09 |
| CVE-2026-75166 Insecure Permission vulnerability in MBS-Solutions X-Serie Gateway firmware V6_0... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-75169 An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solution... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-75161 An issue in the ugw-restart method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Ser... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-19303 IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacke... |
high | 8.1 | — | Langflow / langflow | 2026-09-04 | 2026-09-10 |
| CVE-2026-19304 IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacke... |
high | 7.7 | — | Langflow / langflow | 2026-09-04 | 2026-09-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.