September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-94396 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of... |
medium | 6.5 | — | Elastic / elasticsearch | 2026-09-26 | 2026-09-29 |
| CVE-2026-94397 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of... |
medium | 6.5 | — | Elastic / elasticsearch | 2026-09-26 | 2026-09-29 |
| CVE-2026-94398 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of... |
medium | 6.5 | — | Elastic / elasticsearch | 2026-09-26 | 2026-09-29 |
| CVE-2026-94399 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of... |
medium | 6.5 | — | Elastic / elasticsearch | 2026-09-26 | 2026-09-29 |
| CVE-2026-94400 Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service... |
medium | 6.5 | — | Elastic / kibana | 2026-09-26 | 2026-09-29 |
| CVE-2026-94408 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of... |
medium | 4.9 | — | Elastic / elasticsearch | 2026-09-26 | 2026-10-06 |
| CVE-2026-72662 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to... |
medium | 6.3 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-78582 Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of d... |
medium | 6.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-82294 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial... |
medium | 6.5 | — | Elastic / elasticsearch | 2026-09-26 | 2026-09-29 |
| CVE-2026-82300 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial... |
medium | 6.5 | — | Elastic / elasticsearch | 2026-09-26 | 2026-10-01 |
| CVE-2026-100719 Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in... |
medium | 6.5 | — | — | 2026-09-26 | 2026-09-26 |
| CVE-2026-100710 Froxlor through 2.3.10 does not filter sensitive columns from API responses: Dom... |
medium | 4.9 | — | — | 2026-09-26 | 2026-09-26 |
| CVE-2026-100712 froxlor through 2.3.10 disables a user's two-factor authentication immediately u... |
medium | 6.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100701 Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is... |
medium | 5.9 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100702 Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recip... |
medium | 5.9 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100694 Hugo is a static site generator. |
medium | 6.1 | — | Gohugo / hugo | 2026-09-26 | 2026-09-30 |
| CVE-2026-100695 Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CON... |
medium | 6.1 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100696 Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Fo... |
medium | 5.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100698 Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the h... |
medium | 5.8 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100699 Nodemailer is a Node.js email-sending library. |
medium | 5.3 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100687 Budibase Server before 3.45.0 fails to redact plaintext datasource credentials b... |
medium | 5.5 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100688 Budibase server before 3.45.0 contains a cross-tenant information disclosure vul... |
medium | 6.5 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100689 GitPython before 3.1.62 does not validate the `path` field read from an untruste... |
medium | 5.9 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100691 Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulne... |
medium | 5.4 | — | Gohugo / hugo | 2026-09-26 | 2026-09-29 |
| CVE-2026-100681 Budibase before 3.45.0 contains an unauthenticated server-side request forgery a... |
medium | 5.4 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100674 stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization... |
medium | 4.3 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100675 stoatchat versions before 0.15.5 contain a denial of service vulnerability in th... |
medium | 6.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100677 stoatchat before 0.15.5 contains an account enumeration vulnerability in the log... |
medium | 5.3 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100678 stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA log... |
medium | 6.5 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100667 grav-plugin-login (the Grav CMS Login plugin) versions >= 3.8.7 and < 3.9.7 allo... |
medium | 5.3 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100668 Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. |
medium | 6.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100654 vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatib... |
medium | 6.5 | — | Vllm / vllm | 2026-09-26 | 2026-10-07 |
| CVE-2026-100659 Netty's HTTP/3 codec (io.netty:netty-codec-http3) in versions 4.2.0.Final throug... |
medium | 6.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100648 vllm before 0.29.0 fails to enforce VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit in mul... |
medium | 5.3 | — | Vllm / vllm | 2026-09-26 | 2026-10-06 |
| CVE-2026-100649 vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCo... |
medium | 5.3 | — | Vllm / vllm | 2026-09-26 | 2026-10-06 |
| CVE-2026-100650 vLLM through 0.29.0 fetches and fully materializes remote or inline media before... |
medium | 6.5 | — | Vllm / vllm | 2026-09-26 | 2026-10-06 |
| CVE-2026-100651 vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disa... |
medium | 6.5 | — | Vllm / vllm | 2026-09-26 | 2026-10-06 |
| CVE-2026-100653 vLLM is an inference and serving engine for large language models. |
medium | 6.5 | — | Vllm / vllm | 2026-09-26 | 2026-10-20 |
| CVE-2026-100635 SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publ... |
medium | 5.9 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100640 SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC ha... |
medium | 4.7 | — | — | 2026-09-26 | 2026-10-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.