September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-101145 A vulnerability was identified in Eleveo Call Recording Software 9.7.0. |
medium | 4.3 | — | — | 2026-09-28 | 2026-10-20 |
| CVE-2026-101146 A security flaw has been discovered in Eleveo Quality Management 9.7.0. |
medium | 4.3 | — | — | 2026-09-28 | 2026-10-20 |
| CVE-2026-100370 DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. |
medium | 4.7 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101914 @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, wi... |
medium | 6.5 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101142 A vulnerability has been found in Eleveo Quality Management 9.7.0. |
medium | 6.3 | — | — | 2026-09-28 | 2026-10-20 |
| CVE-2026-101143 A vulnerability was found in Eleveo Quality Management 9.7.0. |
medium | 4.3 | — | — | 2026-09-28 | 2026-10-20 |
| CVE-2026-97686 Wind River VxWorks 7 prior to 26.09, specific system call arguments can result i... |
medium | 5.5 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-13018 Insufficient validation of untrusted input in Codecs in Google Chrome prior to 1... |
medium | 4.3 | — | Google / chrome | 2026-09-28 | 2026-09-29 |
| CVE-2026-101109 Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Mana... |
medium | 6.1 | — | Ordasoft / vehicle manager | 2026-09-28 | 2026-10-27 |
| CVE-2026-101111 Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library... |
medium | 6.1 | — | Ordasoft / book library | 2026-09-28 | 2026-10-01 |
| CVE-2026-100753 Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate... |
medium | 6.1 | — | Ordasoft / real estate manager | 2026-09-28 | 2026-10-27 |
| CVE-2026-101105 A vulnerability was determined in code-projects Matrimonial System 1.0. |
medium | 6.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-96740 A flaw was found in the StreamsHub Console for Apache Kafka. |
medium | 6.5 | — | — | 2026-09-28 | 2026-10-05 |
| CVE-2026-55156 Token Optimizer MCP measures token savings per AI coding agent, optimizes contex... |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101101 A vulnerability has been found in ag-ui-protocol ag-ui up to 2026-09-07. |
medium | 4.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101102 A vulnerability was found in deepseek-ai deepseek-harness up to 0.1.0-rc.7. |
medium | 6.3 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101099 A vulnerability was detected in ag-ui-protocol ag-ui up to 2026-09-23. |
medium | 4.3 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101100 A flaw has been found in ag-ui-protocol ag-ui up to 2026-09-07. |
medium | 5.4 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-88815 DBI versions before 1.654 for Perl incorrectly treat numeric values as strings i... |
medium | 6.2 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101082 A weakness has been identified in PMWeb 7.x/8.x/2025.x. |
medium | 5.3 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101083 A security vulnerability has been detected in PMWeb v7.x/v8.x/v2025.x. |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101098 A security vulnerability has been detected in ag-ui-protocol ag-ui up to 2026-09... |
medium | 4.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101861 Langflow 1.0.16 before 1.12.0 and 0.0.94 before 1.12.0 contain an unsafe eval()... |
medium | 4.1 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101078 A vulnerability has been found in deepseek-ai deepseek-harness up to 0.1.7-rc.2. |
medium | 6.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101080 A vulnerability was identified in Tencent AI-Infra-Guard up to 4.5.2/4.6.2. |
medium | 4.8 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-93539 A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webho... |
medium | 5.4 | — | Suse / rancher fleet | 2026-09-28 | 2026-10-07 |
| CVE-2026-93540 A privilege mismatch was found in Fleet. |
medium | 6.5 | — | Suse / rancher fleet | 2026-09-28 | 2026-10-07 |
| CVE-2026-80359 Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contai... |
medium | 6.8 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-70413 Dell Live Optics Collector, versions prior to 27.2.13.310, contain(s) a Use of H... |
medium | 5.6 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-80358 Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contai... |
medium | 5.1 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-93537 A user who can supply bundle content to a repository referenced by a GitRepo res... |
medium | 6.5 | — | Suse / rancher fleet | 2026-09-28 | 2026-10-07 |
| CVE-2026-87798 Improper link resolution in the recursive file pull feature of the LXD CLI clien... |
medium | 5.8 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-86334 Path traversal in the CLI client image export and copy functionality in Canonica... |
medium | 4.2 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-86335 Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, a... |
medium | 6.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-15952 Incorrect Permission Assignment for Critical Resource vulnerability in ABB Prote... |
medium | 6.4 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-15953 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
medium | 5.0 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101070 A security vulnerability has been detected in dbgate up to 7.3.1. |
medium | 5.3 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101071 A vulnerability was determined in Acrel Electric Unet Web Service up to 20260814... |
medium | 6.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82326 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 4.1 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-59563 Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation... |
medium | 4.6 | — | — | 2026-09-28 | 2026-09-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.