September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-57141 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-57147 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-57148 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-62379 Open Access Management (OpenAM) is an access management solution. |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-25 |
| CVE-2026-90711 proxy-addr is a Node.js module that determines a request's client address behind... |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91003 A flaw has been found in D-Link DI-8300 16.07. |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-91001 A security flaw has been discovered in D-Link DI-8400 16.07. |
critical | 9.9 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90847 A vulnerability was determined in EFM ipTIME C200E 1.094. |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-12944 IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary P... |
critical | 9.6 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-86881 A certificate validation issue was addressed with improved certificate validatio... |
critical | 9.1 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84625 A permissions issue was addressed with additional sandbox restrictions. |
critical | 9.1 | — | Apple / ipados | 2026-09-14 | 2026-09-23 |
| CVE-2026-84609 A permissions issue was addressed with improved path validation. |
critical | 9.8 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84561 A double free issue was addressed with improved memory management. |
critical | 9.8 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-84520 A buffer overflow was addressed with improved size validation. |
critical | 9.8 | — | Apple / macos | 2026-09-14 | 2026-09-16 |
| CVE-2026-65414 An out-of-bounds write issue was addressed with improved bounds checking. |
critical | 9.8 | — | Apple / ipados | 2026-09-14 | 2026-09-16 |
| CVE-2026-65381 A validation issue existed in the entitlement verification. |
critical | 10.0 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-53713 Envoy Gateway is an open source project for managing Envoy Proxy as a standalone... |
critical | 9.1 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-43790 The issue was addressed with improved memory handling. |
critical | 9.1 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-55209 resdata is software for reading and writing result files from the Eclipse reserv... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54334 UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures includi... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54333 UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures includi... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-50006 Anyquery is an SQL query engine built on top of SQLite. |
critical | 9.1 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-18119 Concrete CMS below 9.5.3 did not sanitize custom style values in the Block Desig... |
critical | 9.0 | — | Concretecms / concrete cms | 2026-09-14 | 2026-09-18 |
| CVE-2026-59178 ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-90945 Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-90942 Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certific... |
critical | 9.6 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-76461 Cisco Secure Email Gateway SQL Injection Vulnerability |
critical | 9.8 | Listed | Cisco / Secure Email Gateway | 2026-09-14 | 2026-09-15 |
| CVE-2026-76440 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-76441 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-76443 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-20353 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-61534 Yayson is a library for serializing and reading JSON API data in JavaScript. |
critical | 9.1 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-57145 PraisonAI is a multi-agent teams system. |
critical | 9.1 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-57131 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-57124 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-57127 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82431 Description
`SimpleACLAuthorizer` evaluated the user-level command set by retur... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-82435 Description
The worker's Netty message decoder is installed ahead of the SASL a... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-57123 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-57125 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.