September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-101004 A security vulnerability has been detected in notionnext-org NotionNext up to 4.... |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100907 A flaw has been found in Eyeplus 57.0.0.0308. |
medium | 5.3 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-100906 A vulnerability was detected in Eyeplus 57.0.0.0308. |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100903 A vulnerability was identified in ООО НПО Ритм GEOritm up to 2.45.1. |
medium | 5.3 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-100902 A vulnerability was determined in Barco ClickShare CX-20 Gen2 up to 02.26.00.000... |
medium | 6.5 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100899 A flaw has been found in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/... |
medium | 6.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100900 A vulnerability has been found in DevaslanPHP project-management 1.2.1/1.2.2/1.2... |
medium | 5.5 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-100894 A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to... |
medium | 6.3 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-100895 A security flaw has been discovered in Trusted Domain Project OpenARC up to 1.0.... |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100897 A security vulnerability has been detected in fuzui StudentInfo up to fcc42a639e... |
medium | 5.5 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-100898 A vulnerability was detected in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3... |
medium | 6.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100890 A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100892 A vulnerability was found in aligungr UERANSIM up to 3.3.0. |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100887 A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Manage... |
medium | 6.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100883 A flaw has been found in Krayin laravel-crm up to 2.2.5. |
medium | 6.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100884 A vulnerability has been found in Krayin laravel-crm up to 2.2.5. |
medium | 4.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-96281 On a multi-user system, a user with an active local login session could downgrad... |
medium | 6.2 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-101085 Nezha before 2.3.8 fails to validate alert rule type and duration bounds, allowi... |
medium | 6.5 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-101086 Nezha Dashboard versions before 2.3.5 fail to restrict service monitor task type... |
medium | 6.5 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-101087 Nezha versions 2.0.10 through 2.3.2 use a restricted HTTP client to validate use... |
medium | 4.3 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-101088 Nezha is a server and website monitoring tool. |
medium | 5.3 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100878 A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. |
medium | 6.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100879 A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. |
medium | 4.3 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-101063 Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endp... |
medium | 5.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100877 A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project up to... |
medium | 4.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-96279 A malicious OCI registry can hardlink arbitrary host files into the extraction d... |
medium | 6.5 | — | — | 2026-09-27 | 2026-09-29 |
| CVE-2026-100876 A vulnerability was found in mathurvishal CloudClassroom-PHP-Project up to 5dade... |
medium | 6.3 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100873 A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5d... |
medium | 4.3 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-101061 utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side reques... |
medium | 4.7 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-101046 Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list... |
medium | 4.3 | — | Fleetdm / fleet | 2026-09-27 | 2026-10-07 |
| CVE-2026-101047 Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS a... |
medium | 5.3 | — | Fleetdm / fleet | 2026-09-27 | 2026-10-07 |
| CVE-2026-101048 Cloudreve before 4.17.0 registers the administrative node test endpoints (POST /... |
medium | 5.4 | — | — | 2026-09-27 | 2026-10-08 |
| CVE-2026-101056 Cloudreve before 4.16.1 fails to revalidate share access when restoring cached n... |
medium | 5.3 | — | — | 2026-09-27 | 2026-10-08 |
| CVE-2026-101058 python-utcp (pip package utcp-http) before 1.1.12 does not verify whether tool U... |
medium | 6.9 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-101050 Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on... |
medium | 6.5 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-101042 Parse Server is an open-source backend server. |
medium | 6.4 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-101049 Heym before 0.0.53 fails to verify Slack request signatures when trigger nodes l... |
medium | 6.5 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-101033 KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller... |
medium | 4.3 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100869 Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions... |
medium | 5.9 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100868 Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network... |
medium | 6.3 | — | — | 2026-09-27 | 2026-10-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.