September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-18320 Readwise Reader for Android uses a sanitize-html configuration that permits all... |
medium | 6.1 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-100237 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-18311 Readwise Reader for Android contains a cross-site scripting vulnerability due to... |
medium | 6.1 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-18312 Readwise Reader for Android constructs URLs in its WebView using attacker-contro... |
medium | 6.1 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-97869 A flaw has been found in langchain4j up to 1.5.3-beta10/1.11.10-beta18/1.18.1-be... |
medium | 4.1 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-97469 PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked u... |
medium | 4.3 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-85274 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
medium | 6.5 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-85289 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
medium | 6.5 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-85290 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
medium | 5.3 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-85291 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
medium | 6.5 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-85292 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
medium | 4.8 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-85293 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
medium | 4.8 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-67236 RabbitMQ is a messaging and streaming broker. |
medium | 6.5 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-15 |
| CVE-2026-54790 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
medium | 6.0 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-39372 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
medium | 4.9 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-100230 Input Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-dr... |
medium | 5.3 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-97866 A weakness has been identified in Zhonglun CloudPOS 3.0. |
medium | 5.6 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-84882 IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the Univers... |
medium | 6.5 | — | Ibm / guardium data protection | 2026-09-25 | 2026-10-20 |
| CVE-2026-88389 Espruino 2v29 (commit bffc6d0) contains a NULL pointer dereference vulnerability... |
medium | 6.2 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-93030 FTM 4.x ALL could allow a remote authenticated attacker to obtain sensitive info... |
medium | 6.5 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-97864 A vulnerability has been found in GibbonEdu Gibbon up to 30.0.01. |
medium | 5.3 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-98160 In the Linux kernel, the following vulnerability has been resolved:
staging: rt... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-19 |
| CVE-2026-98161 In the Linux kernel, the following vulnerability has been resolved:
nvdimm: pme... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-21 |
| CVE-2026-98162 In the Linux kernel, the following vulnerability has been resolved:
smb/server:... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-21 |
| CVE-2026-97222 A heap use-after-free flaw was found in Gnumeric. |
medium | 5.5 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-84893 IBM Guardium Data Protection 12.2 is vulnerable to SQL injection in the PESI ser... |
medium | 6.5 | — | Ibm / guardium data protection | 2026-09-25 | 2026-10-20 |
| CVE-2026-100079 In the Linux kernel, the following vulnerability has been resolved:
usb: typec:... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-19 |
| CVE-2026-100076 In the Linux kernel, the following vulnerability has been resolved:
staging: rt... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-30 |
| CVE-2026-100077 In the Linux kernel, the following vulnerability has been resolved:
drm/msm: Re... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-30 |
| CVE-2026-100078 In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwi... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-19 |
| CVE-2026-100070 In the Linux kernel, the following vulnerability has been resolved:
netfilter:... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-20 |
| CVE-2026-100071 In the Linux kernel, the following vulnerability has been resolved:
net: hsr: f... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-21 |
| CVE-2026-100073 In the Linux kernel, the following vulnerability has been resolved:
ext4: fix t... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-21 |
| CVE-2026-100074 In the Linux kernel, the following vulnerability has been resolved:
bpf: Mark b... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-21 |
| CVE-2026-78902 Cross Site Scripting vulnerability in Netgate pfSense 26.03.1-RELEASE allows an... |
medium | 6.1 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-88420 A reflected cross-site scripting (XSS) vulnerability in the EntryAbstract.save()... |
medium | 5.4 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-51772 A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2)... |
medium | 6.5 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-98157 In the Linux kernel, the following vulnerability has been resolved:
EDAC/device... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-20 |
| CVE-2026-98158 In the Linux kernel, the following vulnerability has been resolved:
ppp_async:... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-20 |
| CVE-2026-98159 In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76:... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.