September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-91766 When the http:// stream wrapper follows a redirect it forwards the user-supplied... |
medium | 5.9 | — | Php / php | 2026-09-25 | 2026-10-23 |
| CVE-2026-91767 php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the lengt... |
medium | 6.5 | — | Php / php | 2026-09-25 | 2026-10-27 |
| CVE-2026-91769 PHP's OpenSSL stream peer verification checks the certificate's subjectAltName e... |
medium | 4.3 | — | Php / php | 2026-09-25 | 2026-10-23 |
| CVE-2026-100388 RustDesk versions before 1.5.0 fail to properly validate file transfer permissio... |
medium | 5.4 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2025-1218 The mysqlnd wire protocol parser reads fields out of server packets before check... |
medium | 5.9 | — | Php / php | 2026-09-25 | 2026-10-23 |
| CVE-2025-14181 The SOAP HTTP client guards its response buffer growth with a check that relies... |
medium | 6.5 | — | Php / php | 2026-09-25 | 2026-10-23 |
| CVE-2026-93682 When the HTTP stream wrapper follows a redirect and the response carries a Locat... |
medium | 5.8 | — | Php / php | 2026-09-25 | 2026-10-23 |
| CVE-2026-100373 OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability... |
medium | 4.1 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-97895 A vulnerability was determined in krayin laravel-crm up to 2.2.5. |
medium | 6.3 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-100306 TDuck survey form through 6.0 fails to validate write passwords on submission en... |
medium | 5.3 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-100303 TDuck survey form through 6.0 lacks authorization checks on FormThemeController... |
medium | 5.4 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-100304 TDuck survey form 6.0 contains an information disclosure vulnerability in FormAu... |
medium | 5.3 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-100305 TDuck survey form through 6.0 fails to enforce form fill-in restrictions on the... |
medium | 4.3 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-100192 X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /ap... |
medium | 6.5 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-97884 A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5d... |
medium | 6.3 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-97886 A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to... |
medium | 6.3 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-93366 Bludit CMS through 3.22.0 contains an authorization bypass vulnerability that al... |
medium | 5.4 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-97879 A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. |
medium | 5.3 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-93363 The @payloadcms/storage-vercel-blob storage adapter for Payload contains an impr... |
medium | 4.3 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-93364 Bludit CMS through 3.22.0 contains a mass assignment vulnerability that allows a... |
medium | 4.3 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-93365 Bludit CMS through 3.22.0 contains a missing authorization vulnerability that al... |
medium | 6.5 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-67421 RabbitMQ is a messaging and streaming broker. |
medium | 6.8 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-06 |
| CVE-2026-67413 RabbitMQ is a messaging and streaming broker. |
medium | 6.5 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-16 |
| CVE-2026-67415 RabbitMQ is a messaging and streaming broker. |
medium | 4.9 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-16 |
| CVE-2026-67419 RabbitMQ is a messaging and streaming broker. |
medium | 6.5 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-16 |
| CVE-2026-67420 RabbitMQ is a messaging and streaming broker. |
medium | 6.5 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-16 |
| CVE-2026-67239 RabbitMQ is a messaging and streaming broker. |
medium | 5.4 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-16 |
| CVE-2026-67241 RabbitMQ is a messaging and streaming broker. |
medium | 6.5 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-16 |
| CVE-2026-67242 RabbitMQ is a messaging and streaming broker. |
medium | 5.4 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-16 |
| CVE-2026-67406 RabbitMQ is a messaging and streaming broker. |
medium | 6.5 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-16 |
| CVE-2026-67408 RabbitMQ is a messaging and streaming broker. |
medium | 6.5 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-08 |
| CVE-2026-67409 RabbitMQ is a messaging and streaming broker. |
medium | 6.5 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-08 |
| CVE-2026-67226 RabbitMQ is a messaging and streaming broker. |
medium | 4.9 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-20 |
| CVE-2026-67227 RabbitMQ is a messaging and streaming broker. |
medium | 4.9 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-20 |
| CVE-2026-67234 RabbitMQ is a messaging and streaming broker. |
medium | 4.3 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-20 |
| CVE-2026-66073 RabbitMQ is a messaging and streaming broker. |
medium | 6.5 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-08 |
| CVE-2026-66078 RabbitMQ is a messaging and streaming broker. |
medium | 5.5 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-15 |
| CVE-2026-67222 RabbitMQ is a messaging and streaming broker. |
medium | 6.5 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-15 |
| CVE-2026-61837 RabbitMQ is a messaging and streaming broker. |
medium | 5.3 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-15 |
| CVE-2026-66071 RabbitMQ is a messaging and streaming broker. |
medium | 6.5 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.