September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-85617 snipe-it versions before 8.6.3 contain an authorization bypass vulnerability in... |
high | 8.8 | — | Snipeitapp / snipe-it | 2026-09-04 | 2026-09-16 |
| CVE-2026-85604 Grav before 2.0.18 (affected versions <= 2.0.17) contains a remote code executio... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85609 Openpanel before 2.3.0 contains an unauthenticated full-read server-side request... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85610 OpenPanel before 2.3.0 fails to properly validate chart formula expressions, all... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-85612 OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery v... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-14 |
| CVE-2026-85613 OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unau... |
high | 8.2 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85614 OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery v... |
high | 8.6 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85599 Grav Shortcode Core before 6.2.5 contains stored cross-site scripting vulnerabil... |
high | 7.2 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85581 SiYuan before v3.8.2 contains a denial of service vulnerability in the unauthent... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-85584 SiYuan versions before v3.8.2 contain a denial of service vulnerability in the p... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85585 SiYuan before v3.8.2 contains an unbounded resource consumption vulnerability in... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-19051 Plaintext storage of a password vulnerability in Menulux Software Inc. |
high | 7.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-19080 Observable response discrepancy vulnerability in Menulux Software Inc. |
high | 7.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-84428 fastify versions before 5.12.2 implement the case-insensitive nature of HTTP hea... |
high | 7.5 | — | Fastify / fastify | 2026-09-04 | 2026-09-15 |
| CVE-2026-85512 A security flaw has been discovered in SourceCodester Class and Exam Timetabling... |
high | 7.3 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-85540 DreamMaker developed by Interinfo has a SQL Injection vulnerability. |
high | 8.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-84469 fastify versions before 5.12.2 decide whether to compile a request schema based... |
high | 7.5 | — | Fastify / fastify | 2026-09-04 | 2026-09-15 |
| CVE-2026-84504 fastify versions before 5.12.2 treat the object resolved by a successful Ajv asy... |
high | 8.1 | — | Fastify / fastify | 2026-09-04 | 2026-09-15 |
| CVE-2026-76169 fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under... |
high | 7.5 | — | Fastify / fastify | 2026-09-04 | 2026-09-15 |
| CVE-2026-81302 PALLET CONTROL products contain an incorrect default permission vulnerability, w... |
high | 7.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-81665 A heap-based buffer overflow was found in Corosync's Totem Process Group (totemp... |
high | 7.5 | — | — | 2026-09-04 | 2026-10-21 |
| CVE-2026-85525 Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js... |
high | 7.4 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-57777 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-85197 A flaw was found in libsoup. |
high | 7.6 | — | — | 2026-09-04 | 2026-10-22 |
| CVE-2026-85094 The Canva Android App before 2.376.0 did not restrict the headers returned to an... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-81270 Apache Allura: exposure of non-public information via search. |
high | 7.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-66840 XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Una... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-16281 The Classified Listing WordPress plugin before 6.1.1 does not verify that the ca... |
high | 7.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-19224 The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a n... |
high | 7.2 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85505 ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmi_oe... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-85403 A flaw has been found in code-projects Doctor Appointment System 1.0. |
high | 7.3 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-85398 A vulnerability was identified in code-projects Hospital Information System 1.0. |
high | 7.3 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-85399 A security flaw has been discovered in code-projects Hospital Information System... |
high | 7.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85402 A vulnerability was detected in code-projects Doctor Appointment System 1.0. |
high | 7.3 | — | — | 2026-09-04 | 2026-09-11 |
| CVE-2026-85147 SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentia... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85397 A vulnerability was determined in code-projects Hospital Information System 1.0. |
high | 7.3 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-45200 Software installed and run as a non-privileged user may conduct improper GPU dri... |
high | 7.8 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-85379 A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53... |
high | 7.3 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-85380 A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d... |
high | 7.3 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-85450 MOOS core-moos through 10.4.0 contains a denial of service vulnerability in the... |
high | 7.5 | — | Themoos / core-moos | 2026-09-03 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.