September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-52850 Docmost is open-source collaborative wiki and documentation software. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-97232 A vulnerability was determined in volotat Anagnorisis up to 0.4.2. |
medium | 6.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-93405 Mailspring is a fast, cross-platform, open-source email client. |
medium | 6.1 | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-91119 Discourse is an open-source discussion platform. |
medium | 6.4 | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-91120 Discourse is an open-source discussion platform. |
medium | 5.4 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-91121 Discourse is an open-source discussion platform. |
medium | 5.0 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-81508 ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-61784 xhtml-purifier is a Node.js library to take in raw/unknown/untrusted HTML and ou... |
medium | 6.1 | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-61811 Wazuh is an open-source security platform providing unified XDR and SIEM protect... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-57179 Python Social Auth is a social authentication/registration mechanism. |
medium | 4.2 | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-57175 Python Social Auth is a social authentication/registration mechanism. |
medium | 6.4 | — | — | 2026-09-24 | 2026-10-05 |
| CVE-2026-57176 Python Social Auth is a social authentication/registration mechanism. |
medium | 6.8 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-57177 Python Social Auth is a social authentication/registration mechanism. |
medium | 4.3 | — | — | 2026-09-24 | 2026-10-05 |
| CVE-2026-54461 Habitica is a habit tracker application that treats goals like a role-playing ga... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-94281 An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi befo... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-93542 An out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_c... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-93544 An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in libXi before... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-93545 An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-91134 Discourse is an open-source discussion platform. |
medium | 5.4 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-91161 OpenWA is a free, open source, self-hosted WhatsApp API gateway. |
medium | 6.4 | — | — | 2026-09-24 | 2026-10-05 |
| CVE-2026-88385 Mini-XML 4.0.5 contains a memory leak vulnerability in mxml_load_data() during m... |
medium | 6.5 | — | — | 2026-09-24 | 2026-10-06 |
| CVE-2026-91132 Discourse is an open-source discussion platform. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-91133 Discourse is an open-source discussion platform. |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-88377 Bento4 1.6.0.0 contains an integer underflow vulnerability in the avcC and hvcC... |
medium | 6.2 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-88383 libical 4.0.6 contains an incompatible function pointer in icalparameter_string_... |
medium | 6.2 | — | — | 2026-09-24 | 2026-10-06 |
| CVE-2026-88384 OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing... |
medium | 5.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-79762 Termix is a web-based server management platform with SSH terminal, tunneling, a... |
medium | 5.5 | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-79763 Termix is a web-based server management platform with SSH terminal, tunneling, a... |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-84302 Discourse is an open-source discussion platform. |
medium | 4.2 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-88367 NanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvg... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-63498 Snipe-IT is an IT asset/license management system. |
medium | 5.4 | — | Snipeitapp / snipe-it | 2026-09-24 | 2026-09-29 |
| CVE-2026-47132 phpMyFAQ is an open source FAQ web application. |
medium | 5.4 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97226 A vulnerability has been found in DbGate up to 7.2.5/7.3.1-premium-beta.1. |
medium | 6.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97225 A flaw has been found in DbGate up to 7.2.5-beta.5. |
medium | 6.3 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-96745 Deserialization of untrusted data in the command monitoring support of the Mongo... |
medium | 5.6 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96746 An out-of-bounds write in the connection-monitoring logic of the MongoDB C Drive... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-93541 An out-of-bounds read in libXi's XQueryDeviceState() in libXi before 1.8.4 could... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-88371 ZBar commit 2ea2ca58 contains an undefined-behavior vulnerability in the Code 12... |
medium | 5.5 | — | — | 2026-09-24 | 2026-10-06 |
| CVE-2026-92680 Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured... |
medium | 5.5 | — | — | 2026-09-24 | 2026-09-26 |
| CVE-2026-88358 simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::pars... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.