September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-15890 The default AEAD nonce provider for the PSA Internal Trusted Storage transform m... |
medium | 5.3 | — | — | 2026-09-21 | 2026-10-15 |
| CVE-2026-17054 The Espressif ESP-hosted Wi-Fi driver (drivers/wifi/esp_hosted/) parses frames r... |
medium | 5.3 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-46650 Joplin is an open source note-taking and to-do application that organises notes... |
medium | 4.4 | — | — | 2026-09-21 | 2026-09-29 |
| CVE-2026-94588 In Proxmox pmg-api, an argument injection vulnerability exists in the package ch... |
medium | 4.4 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-93433 A flaw was found in libstoragemgmt. |
medium | 5.5 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-88412 An integer overflow in the _BulkInsert_ReadProperty component (/bulk_insert.c) o... |
medium | 5.3 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-88467 CRMEB Knowledge-Paid System crmeb_zzff_class 1.4.4 has a backend verification fu... |
medium | 6.2 | — | — | 2026-09-21 | 2026-10-01 |
| CVE-2026-88745 EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a... |
medium | 6.1 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-88403 A Server-Side Request Forgery (SSRF) in the serverRequest function of nocobase v... |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-88408 FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack ove... |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-79317 A session invalidation flaw exists in x-ui 0.3.2. |
medium | 4.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-79917 MaxKB is an open-source AI assistant for enterprise. |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-79918 MaxKB is an open-source AI assistant for enterprise. |
medium | 6.3 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-79919 MaxKB is an open-source AI assistant for enterprise. |
medium | 6.3 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-77522 MaxKB is an open-source AI assistant for enterprise. |
medium | 4.3 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-77525 MaxKB is an open-source AI assistant for enterprise. |
medium | 4.2 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-77516 MaxKB is an open-source AI assistant for enterprise. |
medium | 5.4 | — | — | 2026-09-21 | 2026-09-28 |
| CVE-2026-77517 MaxKB is an open-source AI assistant for enterprise. |
medium | 5.4 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-77518 MaxKB is an open-source AI assistant for enterprise. |
medium | 5.0 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-77519 MaxKB is an open-source AI assistant for enterprise. |
medium | 5.4 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-77520 MaxKB is an open-source AI assistant for enterprise. |
medium | 5.4 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-73511 Envoy is an open source edge and service proxy designed for cloud-native applica... |
medium | 5.3 | — | Envoyproxy / envoy | 2026-09-21 | 2026-10-05 |
| CVE-2026-73551 Envoy is an open source edge and service proxy designed for cloud-native applica... |
medium | 5.3 | — | Envoyproxy / envoy | 2026-09-21 | 2026-10-05 |
| CVE-2026-58270 Sync-in Server is an open-source platform for file storage, sharing, collaborati... |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-58272 Sync-in Server is an open-source platform for file storage, sharing, collaborati... |
medium | 5.3 | — | — | 2026-09-21 | 2026-09-30 |
| CVE-2026-59816 Joplin is an open source note-taking and to-do application that organises notes... |
medium | 4.3 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-55179 Joplin is an open source note-taking and to-do application that organises notes... |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-79318 web2py 3.2.2-stable (commit a7330a2bf21219fa77860b6665de927dd4f98e6d) is vulnera... |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-79319 Stencil core 4.43.5 is vulnerable to Incorrect Access Control. |
medium | 5.3 | — | — | 2026-09-21 | 2026-09-25 |
| CVE-2026-79320 Stencil core 4.43.5 contains a DOM-based cross-site scripting (XSS) vulnerabilit... |
medium | 6.1 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-73549 Envoy is an open source edge and service proxy designed for cloud-native applica... |
medium | 5.3 | — | Envoyproxy / envoy | 2026-09-21 | 2026-10-05 |
| CVE-2026-62247 Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSock... |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-54915 Tautulli is a Python based monitoring and tracking tool for Plex Media Server. |
medium | 5.4 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-58271 Sync-in Server is an open-source platform for file storage, sharing, collaborati... |
medium | 6.8 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-48521 Envoy is an open source edge and service proxy designed for cloud-native applica... |
medium | 5.9 | — | Envoyproxy / envoy | 2026-09-21 | 2026-10-05 |
| CVE-2026-50572 Envoy is an open source edge and service proxy designed for cloud-native applica... |
medium | 5.9 | — | Envoyproxy / envoy | 2026-09-21 | 2026-10-05 |
| CVE-2026-94413 jshERP through 3.6 fails to redact password hashes in the /user/info endpoint, a... |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94414 jshERP through 3.6 is missing an authorization check on the POST /userBusiness/u... |
medium | 5.4 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94494 jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows... |
medium | 5.0 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-91166 Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. |
medium | 5.7 | — | — | 2026-09-21 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.