September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-54613 Vvveb is a powerful and easy to use CMS with page builder to build websites, blo... |
medium | 5.4 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-16750 The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-50291 OpenImageIO is a toolset for reading, writing, and manipulating image files of a... |
medium | 5.5 | — | Openimageio / openimageio | 2026-09-17 | 2026-09-29 |
| CVE-2026-14311 The Booking for Appointments and Events Calendar – Amelia plugin for WordPress i... |
medium | 5.4 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-16582 The Booking for Appointments and Events Calendar – Amelia plugin for WordPress i... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-93387 Improper state validation in Skia in Google Chrome prior to 153.0.8010.52 allowe... |
medium | 4.3 | — | Google / chrome | 2026-09-17 | 2026-09-18 |
| CVE-2026-93395 A missing lower-bound validation in the bson_new_from_buffer() function of libbs... |
medium | 5.3 | — | Mongodb / c driver | 2026-09-17 | 2026-09-25 |
| CVE-2026-93379 Incorrect authorization in ORB in Google Chrome prior to 153.0.8010.52 allowed a... |
medium | 4.3 | — | Google / chrome | 2026-09-17 | 2026-09-30 |
| CVE-2026-93383 Information leak in Permissions in Google Chrome prior to 153.0.8010.52 allowed... |
medium | 4.3 | — | Google / chrome | 2026-09-17 | 2026-09-18 |
| CVE-2026-93385 Information leak in Paint in Google Chrome prior to 153.0.8010.52 allowed a remo... |
medium | 6.5 | — | Google / chrome | 2026-09-17 | 2026-09-18 |
| CVE-2026-93386 UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 a... |
medium | 5.4 | — | Google / chrome | 2026-09-17 | 2026-09-18 |
| CVE-2026-93376 Out of bounds read in DataTransfer in Google Chrome prior to 153.0.8010.52 allow... |
medium | 6.3 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-77281 Caddy is an extensible server platform that uses TLS by default. |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-67071 HCL DevOps Deploy / HCL Launch is susceptible to an information disclosure vulne... |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-54907 Caddy Proxy Manager is a web interface for managing Caddy Server reverse proxies... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-54918 NetBox Device Type Library is a collection of community-sourced device type defi... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-54521 FairEmail is a fully featured, open source, privacy-friendly email app for Andro... |
medium | 6.1 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-54565 rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. |
medium | 4.7 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-50022 Metacat is data repository software that helps researchers preserve, share, and... |
medium | 5.8 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2021-3030 Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caus... |
medium | 6.1 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92993 A vulnerability was detected in Dromara mayfly-go up to 1.11.5. |
medium | 6.3 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92756 Applications built on MongoDB Entity Framework Core Provider which combine indep... |
medium | 5.5 | — | Mongodb / entity framework core provider | 2026-09-17 | 2026-09-24 |
| CVE-2026-92757 Applications built on MongoDB Entity Framework Core Provider which place a datab... |
medium | 5.5 | — | Mongodb / entity framework core provider | 2026-09-17 | 2026-09-24 |
| CVE-2026-92758 If logging mode is set to DEBUG or a malformed MongoDB connection string is used... |
medium | 5.5 | — | Mongodb / entity framework core provider | 2026-09-17 | 2026-09-24 |
| CVE-2026-54495 The OpenFeature Operator allows users to expose feature flags to applications. |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-92992 A security vulnerability has been detected in Dromara mayfly-go up to 1.11.5. |
medium | 6.3 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-52852 Traccar is an open source GPS tracking system. |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-92927 A vulnerability was found in SourceCodester Drug Recommendation System 1.0. |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-21 |
| CVE-2026-89038 Verizon Cloud for Android (com.vcast.mediamanager) before 26.7.10 contains a pat... |
medium | 6.2 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-54676 Scoold is a Q&A and a knowledge sharing platform for teams. |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54677 Scoold is a Q&A and a knowledge sharing platform for teams. |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-54546 CloudTAK is a browser-based Common Operating Picture and situational awareness t... |
medium | 5.0 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-54551 WireGuard Portal, or wg-portal, is a web-based configuration portal for WireGuar... |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-44235 rabbitmq-c is a C-language AMQP client library for RabbitMQ. |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-8674 Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMA... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-85720 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
medium | 5.9 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-93013 RAGFlow through 0.27.2 contains a path traversal vulnerability in the dev_insert... |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-21 |
| CVE-2026-93015 BlueKitchen BTstack through 1.8.2 fails to validate the peer-reported endpoint c... |
medium | 6.3 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-92881 A security vulnerability has been detected in vgmstream. |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-86861 pgAdmin 4's File Manager save_file endpoint, which backs saving from the Query T... |
medium | 5.9 | — | Pgadmin / pgadmin 4 | 2026-09-17 | 2026-09-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.