September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-102842 A vulnerability was identified in gedelumbung HospitalManagement up to c2d455437... |
medium | 6.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103053 AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the respons... |
medium | 5.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102804 A vulnerability was detected in Nothings stb up to 2c980bb59875b0d32144a71867fbd... |
medium | 6.5 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-86101 An improper authorization vulnerability in WatchGuard Fireware OS's SAML login p... |
medium | 6.5 | — | Watchguard / fireware | 2026-09-30 | 2026-10-08 |
| CVE-2026-103048 URL redirection to untrusted site ('open redirect') vulnerability in The Wikimed... |
medium | 6.1 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-103049 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103050 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103051 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-13224 A path traversal vulnerability in the Fireware OS WebUI management agent allows... |
medium | 4.9 | — | Watchguard / fireware | 2026-09-30 | 2026-10-08 |
| CVE-2026-18105 An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic t... |
medium | 6.5 | — | Watchguard / fireware | 2026-09-30 | 2026-10-08 |
| CVE-2026-103045 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-103046 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-103047 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-71973 U-Boot before 2026.10-rc4 contains an integer overflow vulnerability in sqfs_rea... |
medium | 5.2 | — | — | 2026-09-29 | 2026-10-02 |
| CVE-2026-71974 U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in read_... |
medium | 4.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-71972 U-Boot through 2026.10-rc5 contains an out-of-bounds write vulnerability in the... |
medium | 5.9 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102771 A security vulnerability has been detected in Naichen ThinkCMF up to 8.0.7. |
medium | 4.7 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-81841 Pausing a shared (public) dashboard did not revoke its access token for the endp... |
medium | 5.3 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-81842 An authenticated user with edit permission on one folder can move a library pane... |
medium | 4.3 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102904 JupyterLab is an extensible environment for interactive and reproducible computi... |
medium | 5.4 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-79535 mbailey VoiceMode <= 8.10.1 is vulnerable to OS Command Injection. |
medium | 6.3 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-79348 KitchenAsty through 0.3.0 contains a broken object level authorization (IDOR) vu... |
medium | 4.3 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-79417 Improper Access Control in ArgusMonitor.sys in Argotronic eGbR ArgusMonitor 7.4.... |
medium | 5.3 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-79534 mark3labs mcp-filesystem-server v0.11.1 is vulnerable to Directory Traversal due... |
medium | 5.9 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-76729 A format string vulnerability in the API endpoint of HPE Networking Instant ON A... |
medium | 6.6 | — | — | 2026-09-29 | 2026-10-01 |
| CVE-2026-76730 An authentication bypass vulnerability exists in the PAPI protocol of HPE Networ... |
medium | 6.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-76731 An authentication bypass vulnerability in the captive portal of HPE Networking I... |
medium | 6.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-76732 A local privilege-escalation vulnerability has been discovered in the affected d... |
medium | 6.4 | — | — | 2026-09-29 | 2026-10-01 |
| CVE-2026-76733 A denial-of-service vulnerability exists in the API endpoint of HPE Networking I... |
medium | 4.9 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-76734 A memory corruption vulnerability in the affected interface of HPE Networking In... |
medium | 4.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-76735 A sensitive information disclosure vulnerability exists in the underlying operat... |
medium | 4.1 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-53989 Dockhand before 1.0.36 contains an open redirect vulnerability in the OIDC initi... |
medium | 4.7 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102877 Fider before 0.38.0 contains a server-side request forgery vulnerability due to... |
medium | 4.4 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102879 ClaraVerse through 0.3.1 contains server-side request forgery protection bypasse... |
medium | 5.0 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102329 Cross-site scripting in WebUI in Google Chrome prior to 154.0.8037.92 allowed a... |
medium | 6.1 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102330 Incorrect authorization in SiteIsolation in Google Chrome prior to 154.0.8037.92... |
medium | 6.5 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102318 Out of bounds read in WebGL in Google Chrome prior to 154.0.8037.92 allowed a re... |
medium | 4.7 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102320 Missing authorization in CORS in Google Chrome prior to 154.0.8037.92 allowed a... |
medium | 6.5 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102325 Uninitialized resource in Skia in Google Chrome prior to 154.0.8037.92 allowed a... |
medium | 4.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102310 Missing authorization in Payments in Google Chrome prior to 154.0.8037.92 allowe... |
medium | 6.5 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.