September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-101068 A security flaw has been discovered in dbgate up to 7.3.1. |
medium | 6.5 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101069 A weakness has been identified in dbgate up to 7.3.1. |
medium | 6.5 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101055 A security flaw has been discovered in Thinkware U3000 up to 1.02.04. |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-87752 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101054 A vulnerability was identified in Thinkware U3000 up to 1.02.04. |
medium | 5.3 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-19444 A path traversal vulnerability was discovered in the Kubernetes kubectl client's... |
medium | 6.5 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-101040 A security flaw has been discovered in Ricoh SP 330DN, SP 221, SP C252SF and Afi... |
medium | 6.5 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101018 A vulnerability was determined in dayrui XunruiCMS up to 4.7.2. |
medium | 4.7 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101035 A flaw has been found in aligungr UERANSIM up to 3.3.0. |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101036 A vulnerability has been found in FLB-Music FLB-Music-Player 1.1.8/1.1.9/1.2.0/1... |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-94282 An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion in libX... |
medium | 5.6 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-94283 An out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute p... |
medium | 6.5 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-94284 An out-of-bounds read vulnerability in libX11's XIM trigger-key registration par... |
medium | 5.5 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-94285 An out-of-bounds read in libX11's byte-oriented codeset parser in libX11 before... |
medium | 5.1 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-94287 A denial of service via unsigned underflow in libXpm's write path in libXpm befo... |
medium | 5.5 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-82915 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
medium | 6.5 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82969 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 5.4 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-86507 Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remo... |
medium | 6.1 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101016 A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2. |
medium | 6.5 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101017 A vulnerability was found in Trusted Domain Project OpenDMARC up to 1.4.2. |
medium | 6.5 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-91206 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.1 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-82382 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.1 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82385 Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.... |
medium | 6.5 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-82387 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 5.4 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-82546 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.1 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-91204 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.1 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-82381 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 5.4 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101010 A vulnerability was identified in aaPanel BaoTa up to 11.8.0. |
medium | 4.7 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101011 A security flaw has been discovered in aaPanel BaoTa up to 11.8.0. |
medium | 4.7 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-88828 The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does... |
medium | 5.4 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-89300 The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation... |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-89303 The Post Voting System WordPress plugin through 1.0 does not properly sanitize a... |
medium | 6.4 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-89411 The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a... |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-92996 The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the... |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-93000 The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query... |
medium | 6.8 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101006 A flaw has been found in Frappe HR up to 16.15.0. |
medium | 4.3 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-84744 The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcod... |
medium | 6.5 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-86838 The Bookly WordPress plugin before 28.3 does not validate client-supplied bookin... |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100751 Joomla Extension - regularlabs.com - Privileged stored XSS via data-rlta-url att... |
medium | 6.1 | — | Regularlabs / tabs \& accordions | 2026-09-28 | 2026-10-27 |
| CVE-2026-101003 A weakness has been identified in Cesanta Mongoose up to 7.21. |
medium | 5.3 | — | — | 2026-09-28 | 2026-10-01 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.