September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-61723 FluidSynth is a software synthesizer based on the SoundFont 2 specifications. |
medium | 6.8 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-57222 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
medium | 5.3 | — | Oisf / suricata | 2026-09-18 | 2026-09-29 |
| CVE-2026-57224 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
medium | 6.5 | — | Oisf / suricata | 2026-09-18 | 2026-09-28 |
| CVE-2026-57226 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
medium | 5.9 | — | Oisf / suricata | 2026-09-18 | 2026-09-28 |
| CVE-2026-52745 CordysCRM is an open source AI-powered customer relationship management system t... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-18869 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypa... |
medium | 6.4 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-17262 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to cause a denial of s... |
medium | 5.4 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-11722 IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Serv... |
medium | 4.8 | — | — | 2026-09-18 | 2026-10-22 |
| CVE-2026-11710 IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vu... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-11711 IBM WebSphere Application Server 9.0 and 8.5 is affected by a deserialization vu... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-11539 IBM WebSphere Application Server 9.0 and 8.5 is affected by an authentication by... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-11540 IBM WebSphere Application Server 9.0 and 8.5 could allow a remote attacker to ob... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-11548 IBM WebSphere Application Server 8.5 and 9.0, and and IBM WebSphere Application... |
medium | 4.8 | — | — | 2026-09-18 | 2026-10-22 |
| CVE-2026-11549 IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Serv... |
medium | 6.5 | — | — | 2026-09-18 | 2026-10-22 |
| CVE-2026-75892 In osmo-ggsn 1.14.0 an out of bounds write issue was found in the gtp_decode_pdp... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-11538 IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vuln... |
medium | 5.3 | — | Ibm / websphere application server | 2026-09-18 | 2026-09-24 |
| CVE-2026-93763 A protection mechanism failure in the object-document mapper's encryption config... |
medium | 6.5 | — | Mongodb / mongoid | 2026-09-18 | 2026-09-24 |
| CVE-2026-93764 Mongoid may omit encryption rules for fields declared on embedded models when ge... |
medium | 6.5 | — | Mongodb / mongoid | 2026-09-18 | 2026-09-24 |
| CVE-2026-93751 uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDec... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93750 http-cache-semantics through 4.2.0 contains a cache validation vulnerability in... |
medium | 5.9 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-93432 A flaw was found in the Quarkus Qute template engine. |
medium | 6.1 | — | — | 2026-09-18 | 2026-10-16 |
| CVE-2026-92768 A flaw was found in cockpit-machines. |
medium | 5.5 | — | — | 2026-09-18 | 2026-10-21 |
| CVE-2026-92745 A flaw was found in cockpit-machines. |
medium | 5.0 | — | — | 2026-09-18 | 2026-10-21 |
| CVE-2026-92747 A flaw was found in `cockpit-machines`. |
medium | 5.0 | — | — | 2026-09-18 | 2026-10-21 |
| CVE-2026-84992 md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-81182 SysReptor is a fully customizable pentest reporting platform. |
medium | 4.2 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-77385 Kyoo is a self-hosted media server focused on movies, series, and anime. |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-77386 Kyoo is a self-hosted media server focused on movies, series, and anime. |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-69186 c-ares is an asynchronous resolver library. |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-71537 Paymenter is a free and open-source webshop solution for management of hosting s... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-93533 A vulnerability was determined in spatie Scotty up to 1.4.4. |
medium | 6.3 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-93534 A vulnerability was identified in spatie Scotty up to 1.4.2. |
medium | 6.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-93579 A flaw was found in Netty's HTTP/2 stack. |
medium | 6.5 | — | — | 2026-09-18 | 2026-10-16 |
| CVE-2026-91147 A flaw was found in `cockpit-ws`. |
medium | 5.9 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93338 Grandstream GWN7660ELR before firmware version 1.0.27.6 contains an information... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-77608 Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-77609 Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-77610 Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-77616 Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-77606 Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.