September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2025-36045 IBM TS4300 1.1.0.1 through 1.7.1.1 could allow an authenticated user to cause a... |
medium | 4.3 | — | — | 2026-09-18 | 2026-10-14 |
| CVE-2025-36076 IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 st... |
medium | 4.3 | — | — | 2026-09-18 | 2026-10-14 |
| CVE-2026-93653 A denial of service flaw was found in Poppler's Splash backend. |
medium | 5.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-93660 SQLBot through 1.10.1 fails to verify dashboard ownership in update_resource and... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93685 A flaw was found in the multicluster-observability-addon. |
medium | 5.4 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-93573 A flaw was found in Netty's HTTP/1.1 decoder. |
medium | 6.5 | — | — | 2026-09-18 | 2026-10-15 |
| CVE-2026-93566 A flaw was found in Netty. |
medium | 6.5 | — | — | 2026-09-18 | 2026-10-15 |
| CVE-2026-93506 A vulnerability was determined in SveltyCMS 0.0.6. |
medium | 6.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-85511 A flaw was found in EAP's Elytron. |
medium | 4.2 | — | — | 2026-09-18 | 2026-10-20 |
| CVE-2026-77928 ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability tha... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-77927 ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability tha... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-25684 A file type attribution issue in Zscaler Internet Access File Type Control evalu... |
medium | 4.4 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-16514 gptp_mi_qualify_announce() in subsys/net/l2/ethernet/gptp/gptp_mi.c walks the Pa... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-16515 net_icmpv6_send_error() in subsys/net/ip/icmpv6.c implemented only one of the th... |
medium | 4.7 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2025-13882 IBM Sterling Partner Engagement Manager Essentials Edition 6.3.0.0 through 6.3.0... |
medium | 5.3 | — | — | 2026-09-18 | 2026-10-14 |
| CVE-2025-1350 IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could al... |
medium | 5.3 | — | — | 2026-09-18 | 2026-10-14 |
| CVE-2026-10832 A flaw was found in the DERDecoder class within wildfly-elytron-asn1. |
medium | 5.9 | — | — | 2026-09-18 | 2026-10-20 |
| CVE-2024-56344 IBM Cognos Analytics 12.0.4 through 12.0.4 FP2, and 12.1.0 through 12.1.3 FP1 co... |
medium | 5.9 | — | — | 2026-09-18 | 2026-09-28 |
| CVE-2026-93602 rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL au... |
medium | 4.4 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93595 ArcadeDB before 26.9.1 contains an access control bypass vulnerability in the qu... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-93596 ArcadeDB before 26.9.1 (com.arcadedb:arcadedb-engine <= 26.8.1) fails to bind th... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-93588 ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer derefer... |
medium | 4.3 | — | Imagemagick / imagemagick | 2026-09-18 | 2026-10-29 |
| CVE-2026-93504 A vulnerability has been found in SveltyCMS 0.0.6. |
medium | 6.3 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-93018 Imager versions before 1.036 for Perl disclose uninitialised heap memory reading... |
medium | 5.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-79294 Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-62282 OpenCVE is a vulnerability intelligence platform. |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-93492 A flaw was found in Netty's HTTP/2 HpackEncoder. |
medium | 5.3 | — | — | 2026-09-18 | 2026-10-16 |
| CVE-2026-93578 A flaw was found in Netty's Online Certificate Status Protocol (OCSP) Client. |
medium | 5.9 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-93561 A flaw was found in io.netty/netty-codec-memcache. |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-25 |
| CVE-2026-90884 The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 5.4 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-15797 The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimat... |
medium | 6.4 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-56597 HCL BigFix Service Management is affected by a Sensitive Information Leakage vul... |
medium | 5.3 | — | Hcltech / bigfix service management | 2026-09-18 | 2026-10-14 |
| CVE-2026-40536 An improper limitation of a pathname to a restricted directory ('path traversal'... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-40537 A server-side request forgery (SSRF) vulnerability in PersonMail API in Synology... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-4036 An improper neutralization of special elements used in an SQL command ('SQL inje... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-56595 HCL BigFix Service Management is affected by a CORS Misconfiguration vulnerabili... |
medium | 4.3 | — | Hcltech / bigfix service management | 2026-09-18 | 2026-10-14 |
| CVE-2026-21848 HCL BigFix Service Management is affected by a Security Misconfiguration vulnera... |
medium | 5.0 | — | Hcltech / bigfix service management | 2026-09-18 | 2026-10-14 |
| CVE-2026-40531 An integer overflow or wraparound vulnerability in File Operation in Synology Di... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-40532 A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-40533 An exposure of sensitive information through data queries vulnerability in Deskt... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.