September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-88370 libconfini 1.16.4 contains a heap out-of-bounds write condition involving the bu... |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-79758 Termix is a web-based server management platform with SSH terminal, tunneling, a... |
medium | 5.4 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-79759 Termix is a web-based server management platform with SSH terminal, tunneling, a... |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-79760 Termix is a web-based server management platform with SSH terminal, tunneling, a... |
medium | 6.4 | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-79761 Termix is a web-based server management platform with SSH terminal, tunneling, a... |
medium | 6.6 | — | — | 2026-09-24 | 2026-10-05 |
| CVE-2026-76907 LaSuite Doc is a collaborative note taking, wiki and documentation platform. |
medium | 6.5 | — | — | 2026-09-24 | 2026-10-05 |
| CVE-2025-32000 HCL Sametime is vulnerable to insufficient input sanitization. |
medium | 4.3 | — | — | 2026-09-24 | 2026-10-14 |
| CVE-2026-97224 A vulnerability was detected in Excalidraw up to 0.18.1. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-77825 IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversa... |
medium | 4.9 | — | Ibm / contextforge | 2026-09-24 | 2026-09-29 |
| CVE-2026-77703 Key exchange without entity authentication vulnerability in HAVELSAN Inc. |
medium | 5.9 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-77707 Improper certificate validation vulnerability in HAVELSAN Inc. |
medium | 5.9 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-6544 IBM Concert 1.0.0 through 3.0.0 allows recursive copying of directories without... |
medium | 6.2 | — | Ibm / concert | 2026-09-24 | 2026-09-28 |
| CVE-2026-65422 A flaw in the authorization mechanism for Media Gateway API in Genetec Security... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-18870 IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31,... |
medium | 4.3 | — | Ibm / power system s1122 \(9824-22a\) firmware | 2026-09-24 | 2026-09-30 |
| CVE-2026-97061 Black Candy through 3.2.1 fails to scope playlist search queries to the authenti... |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-97062 Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on... |
medium | 5.4 | — | — | 2026-09-24 | 2026-10-12 |
| CVE-2026-88359 libfyaml 0.9.6 contains a stack exhaustion vulnerability in fy_atom_iter_format(... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-77798 Velociraptor contains a deadlock condition that may be triggered by authenticate... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-17503 IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31,... |
medium | 5.1 | — | Ibm / power system s1122 \(9824-22a\) firmware | 2026-09-24 | 2026-09-30 |
| CVE-2026-17504 IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31,... |
medium | 4.4 | — | Ibm / power system s1122 \(9824-22a\) firmware | 2026-09-24 | 2026-09-29 |
| CVE-2026-17413 IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31,... |
medium | 5.1 | — | Ibm / power system s1122 \(9824-22a\) firmware | 2026-09-24 | 2026-09-30 |
| CVE-2026-94416 An authorization bypass was found in the Ansible Automation Platform (AAP) gatew... |
medium | 6.8 | — | — | 2026-09-24 | 2026-10-21 |
| CVE-2026-88916 Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Privileg... |
medium | 6.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97311 A flaw was found in the Admin REST API of Keycloak, an identity and access manag... |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-19532 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-3253 The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to u... |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-4806 The Custom Thank You Page for WooCommerce plugin for WordPress is vulnerable to... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-16302 The Spectra Legacy – Gutenberg Blocks plugin for WordPress is vulnerable to Sens... |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97179 A security vulnerability has been detected in O2OA up to 9.5.3/10.0.2. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-92905 ZohoCorp ManageEngine EventLog Analyzer and Log360 before build 13071 were vulne... |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-18335 The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordP... |
medium | 5.4 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-15731 The WP Multilang – Translation and Multilingual Plugin plugin for WordPress is v... |
medium | 6.4 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-78310 Authorization Bypass Through User-Controlled Key in DIAEnergie. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-78313 Improper Access Control in DIAEnergie. |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97181 GPM LIGHT developed by ezGlobal has a Sensitive Data Exposure vulnerability. |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-81645 Out-of-bounds read vulnerability in the graphics module. |
medium | 5.9 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-93662 The Events Manager WordPress plugin before 7.4.5 does not force the scope of its... |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97176 A flaw was found in the Level of Authentication enforcement mechanism of Keycloa... |
medium | 4.2 | — | — | 2026-09-24 | 2026-09-26 |
| CVE-2026-97177 A flaw was found in the user update mechanism of the Keycloak Admin REST API. |
medium | 6.6 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-88845 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not per... |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.