September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-102261 A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. |
medium | 5.4 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-97029 Flatpak's process ID namespace separation does not prevent a sandboxed app's kil... |
medium | 5.7 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102247 A vulnerability was detected in FastAdmin 1.6.1.20250430/1.6.5.20260602. |
medium | 6.8 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102244 A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. |
medium | 4.3 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-101858 A flaw has been found in RaspAP raspap-webgui up to 3.5.5. |
medium | 4.7 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-101859 A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5. |
medium | 5.4 | — | — | 2026-09-29 | 2026-10-01 |
| CVE-2026-102372 GestSup versions before 3.2.61 fail to properly sanitize HTML email bodies in th... |
medium | 6.1 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102373 GestSup versions before 3.2.62 fail to validate ticket ownership when loading co... |
medium | 6.5 | — | — | 2026-09-29 | 2026-10-01 |
| CVE-2026-102374 GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerabili... |
medium | 6.1 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-101278 A weakness has been identified in Trusted Domain Project OpenDMARC up to 1.4.2. |
medium | 4.3 | — | — | 2026-09-29 | 2026-10-01 |
| CVE-2026-101279 A security vulnerability has been detected in Trusted Domain Project OpenDMARC u... |
medium | 6.5 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102367 mall4j through 4.0 contains an insufficient session expiration vulnerability in... |
medium | 5.4 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-18417 The native BSD-socket layer recorded a pending asynchronous socket error by type... |
medium | 6.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-18746 parse_write_op() in subsys/net/lib/lwm2m/lwm2m_message_handling.c handles inboun... |
medium | 5.9 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-18747 The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit pac... |
medium | 6.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-101277 A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.1... |
medium | 6.5 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102362 mall4j through 4.0 fails to implement authentication controls on the DELETE /pro... |
medium | 5.3 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102364 mall4j through 4.0 fails to validate the sysType field in sa-token sessions, all... |
medium | 5.4 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102365 mall4j through 4.0 fails to enforce authorization checks on GET endpoints in Use... |
medium | 6.5 | — | — | 2026-09-29 | 2026-10-01 |
| CVE-2026-102366 mall4j through 4.0 contains an unrestricted file upload vulnerability in FileCon... |
medium | 4.4 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102332 Dozzle versions before 11.1.2 fail to sanitize container display names when buil... |
medium | 6.1 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-102333 httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs... |
medium | 6.1 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-102296 ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in Remo... |
medium | 6.5 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-102297 ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the F... |
medium | 4.3 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101202 A flaw has been found in FastStone Image Viewer up to 8.3. |
medium | 6.3 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-101203 A vulnerability has been found in FastStone Image Viewer up to 8.3. |
medium | 6.3 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-101204 A vulnerability was found in FastStone Image Viewer up to 8.3. |
medium | 6.3 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101205 A vulnerability was determined in FastStone Image Viewer up to 8.3. |
medium | 6.3 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-101092 SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAtt... |
medium | 5.3 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101093 Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in adm... |
medium | 5.4 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2024-58386 ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability... |
medium | 6.5 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-91095 In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWeb... |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-18416 The CoAP link-format helper match_path_uri() in subsys/net/lib/coap/coap_link_fo... |
medium | 5.3 | — | Zephyrproject / zephyr | 2026-09-28 | 2026-10-27 |
| CVE-2026-102277 The brace-expansion library generates arbitrary strings containing a common pref... |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-102265 PyJWT is a Python implementation of JSON Web Token standards. |
medium | 5.3 | — | Pyjwt Project / pyjwt | 2026-09-28 | 2026-10-07 |
| CVE-2026-102269 PyJWT is a Python implementation of JSON Web Token standards. |
medium | 5.4 | — | Pyjwt Project / pyjwt | 2026-09-28 | 2026-10-06 |
| CVE-2026-102270 PyJWT is a Python implementation of JSON Web Token standards. |
medium | 4.9 | — | Pyjwt Project / pyjwt | 2026-09-28 | 2026-10-06 |
| CVE-2026-102005 Wind River VxWorks 7 24.03 through 26.03, a memory leak occurs under specific, n... |
medium | 5.5 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-102006 In Wind River VxWorks 7 prior to 26.09, specific system call arguments can resul... |
medium | 5.5 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101144 A vulnerability was determined in Eleveo Call Recording Software 9.7.0. |
medium | 6.3 | — | — | 2026-09-28 | 2026-10-20 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.