September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84187 AVideo contains a missing authentication vulnerability in plugin/Live/on_publish... |
high | 8.2 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84189 LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit mes... |
high | 8.1 | — | — | 2026-09-01 | 2026-10-08 |
| CVE-2026-84190 LibreNMS versions before 26.5.0 contain a remote code execution vulnerability in... |
high | 7.2 | — | — | 2026-09-01 | 2026-10-08 |
| CVE-2026-84192 LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in l... |
high | 7.1 | — | — | 2026-09-01 | 2026-10-08 |
| CVE-2026-76111 Dell PowerStore contains an Incorrect Authorization vulnerability. |
high | 8.8 | — | Dell / powerstoreos | 2026-09-01 | 2026-09-30 |
| CVE-2026-83595 AVideo contains a cross-site request forgery vulnerability in plugin/API/set.jso... |
high | 8.1 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84059 A flaw has been found in ICP DAS UA-2200 and UA-5200 up to 20260704. |
high | 7.4 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-59680 An OS command injection vulnerability was found in yast2-users. |
high | 8.0 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-59681 A OS command injection vulnerability in yast2-auth-client allows an attacker who... |
high | 8.8 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-19914 The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site S... |
high | 7.2 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-25706 Improper neutralization of special elements used in an OS command in yast2-samba... |
high | 7.5 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-19573 The Affiliate Super Assistent plugin for WordPress is vulnerable to Stored Cross... |
high | 7.2 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-19796 The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin... |
high | 7.2 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-19806 The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Tick... |
high | 8.8 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-19952 The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary... |
high | 7.5 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-75921 The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder,... |
high | 7.2 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-65643 Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated user... |
high | 8.8 | — | Cpanel / cpanel | 2026-09-01 | 2026-10-14 |
| CVE-2026-103587 QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in... |
medium | 5.4 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-103588 QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in... |
medium | 5.4 | — | — | 2026-09-30 | 2026-10-06 |
| CVE-2026-103589 QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in... |
medium | 5.4 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-103590 QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in... |
medium | 5.4 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-103592 simple-php-router through 5.4.1.7 contains an IP restriction bypass vulnerabilit... |
medium | 6.5 | — | — | 2026-09-30 | 2026-10-06 |
| CVE-2026-103001 PyJWT is a Python implementation of JSON Web Token standards. |
medium | 6.5 | — | Pyjwt Project / pyjwt | 2026-09-30 | 2026-10-08 |
| CVE-2026-47096 AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulne... |
medium | 6.1 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-102144 A resource exhaustion vulnerability in Kiteworks Email Protection Gateway allowe... |
medium | 5.3 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102145 An authenticated administrator could cause the server to issue requests to, and... |
medium | 6.6 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-13 |
| CVE-2026-102146 An authenticated Email Protection Gateway administrator holding only limited, de... |
medium | 6.5 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-13 |
| CVE-2026-102134 Kiteworks Core did not apply its gateway-level API security controls to every re... |
medium | 5.4 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102135 On a Kiteworks Email Protection Gateway cluster with database replication enable... |
medium | 6.6 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-08 |
| CVE-2026-102136 In multi-node deployments, an attacker who had already obtained code execution o... |
medium | 6.3 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-13 |
| CVE-2026-102137 An authenticated administrator could bypass the content validation applied to an... |
medium | 4.1 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-13 |
| CVE-2026-102139 An authorization check in the large file exchange feature of Kiteworks Email Pro... |
medium | 6.5 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102140 An authenticated administrator could initiate an administrative import using a f... |
medium | 4.9 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-13 |
| CVE-2026-102141 Two Kiteworks Core cluster-management operations did not validate file paths sup... |
medium | 6.7 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102133 An optional, separately licensed repository-connector feature in Kiteworks Core... |
medium | 6.6 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-08 |
| CVE-2026-102122 Kiteworks did not correctly enforce which roles a shared folder's manager was pe... |
medium | 4.3 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102124 A Kiteworks appliance setup interface did not enforce authentication once the ap... |
medium | 6.5 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-08 |
| CVE-2026-102111 Kiteworks did not enforce the maximum permitted value for a configurable securit... |
medium | 4.9 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102107 Kiteworks Core contains a business logic flaw in a Kiteworks file-request featur... |
medium | 4.6 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102110 An endpoint used during initial appliance setup did not require authentication a... |
medium | 5.9 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.