September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-94387 Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in... |
medium | 5.4 | — | — | 2026-09-21 | 2026-09-28 |
| CVE-2025-71419 UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulner... |
medium | 5.4 | — | — | 2026-09-21 | 2026-10-14 |
| CVE-2025-71420 UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerabilit... |
medium | 4.3 | — | — | 2026-09-21 | 2026-10-14 |
| CVE-2026-94214 A vulnerability was found in ST Engineering iDirect iDX and Evo iDX. |
medium | 4.3 | — | — | 2026-09-21 | 2026-10-14 |
| CVE-2026-94216 A vulnerability was determined in ST Engineering iDirect iDX and Evo iDX. |
medium | 4.3 | — | — | 2026-09-21 | 2026-10-14 |
| CVE-2026-91867 When Neethi fetches a remote policy reference, it only limits the time per read,... |
medium | 4.3 | — | Apache / neethi | 2026-09-21 | 2026-09-25 |
| CVE-2026-85113 The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters f... |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-92400 The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does... |
medium | 5.3 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94151 A weakness has been identified in Omega Solution HRM OS up to 20260717. |
medium | 5.3 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94152 A security vulnerability has been detected in Omega Solution FBP Fulfillment by... |
medium | 4.3 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-85010 The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplie... |
medium | 5.3 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94149 A vulnerability was identified in Omega Solution HRM OS up to 20260717. |
medium | 4.3 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94148 A vulnerability was determined in ScadaBR up to 1.1. |
medium | 5.3 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94213 A flaw was found in the Authorization Services component of Keycloak, an open-so... |
medium | 4.9 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94215 A flaw was found in the Admin REST API of Keycloak, an open-source identity and... |
medium | 5.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94138 A security flaw has been discovered in Chengdu Feiyuxing Technology Feiyu Star R... |
medium | 6.6 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94185 nvm resolves a requested version or alias by treating it as a filename under $NV... |
medium | 5.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94102 A flaw has been found in WuzhiCMS up to 4.1.0. |
medium | 4.3 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-94103 A vulnerability has been found in RooCMS up to 1.2.2/1.3.4/1.4RC2. |
medium | 4.7 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94092 A vulnerability was detected in dmlc dgl up to 2.1.0. |
medium | 5.5 | — | — | 2026-09-20 | 2026-09-24 |
| CVE-2026-94093 A security vulnerability has been detected in DLR-RM stable-baselines3 up to 2.9... |
medium | 6.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94094 A flaw has been found in OpenClaw up to 2026.9.5. |
medium | 4.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-94091 A weakness has been identified in piskvorky gensim up to 4.4.0. |
medium | 5.5 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94090 A security flaw has been discovered in JusticeRage Manalyze 1.0.0. |
medium | 6.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94050 A vulnerability has been found in D-Link DIR-X1860Z up to 1.0.2.220120.165402. |
medium | 4.3 | — | — | 2026-09-20 | 2026-09-24 |
| CVE-2026-94051 A vulnerability was found in 0717376 cowork_bench up to d943e75bc0fc8e3b27141979... |
medium | 6.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94048 A vulnerability was detected in CodeAstro QR Code Attendance Management System 1... |
medium | 6.6 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94049 A flaw has been found in 06ketan slideshot up to 4.4.0. |
medium | 4.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94047 A security vulnerability has been detected in samanhappy MCPHub up to 1.0.32. |
medium | 6.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-94046 A weakness has been identified in 0215AndrewFeng ACE-MCP up to 4.10.8. |
medium | 4.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94043 A vulnerability was determined in Free5GC up to 4.2.3. |
medium | 5.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94041 A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up... |
medium | 6.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94042 A vulnerability was found in AdithyaYelloju Restaurant Management System up to 7... |
medium | 6.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-94037 A weakness has been identified in 00Kisumi00 mcp-file-analyzer up to 84740852f0c... |
medium | 4.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-94040 A flaw has been found in vas3k TaxHacker up to 0.8.5. |
medium | 5.3 | — | — | 2026-09-20 | 2026-09-24 |
| CVE-2026-94035 A vulnerability was determined in SourceCodester Drug Recommendation System 1.0. |
medium | 4.3 | — | — | 2026-09-20 | 2026-09-24 |
| CVE-2026-94032 A flaw has been found in itsourcecode Leave Management System 1.0. |
medium | 6.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-94031 A vulnerability was detected in 0-Gaurav-0 nexus-mcp aed0026e7ac1f23dc940e46e9fd... |
medium | 6.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94028 A weakness has been identified in mealie-recipes Mealie up to 3.25.1. |
medium | 4.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94113 Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an infor... |
medium | 6.5 | — | — | 2026-09-20 | 2026-09-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.