September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86862 pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database'... |
medium | 6.5 | — | Pgadmin / pgadmin 4 | 2026-09-17 | 2026-09-21 |
| CVE-2026-85718 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
medium | 5.9 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-85999 Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-86000 Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-85717 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
medium | 6.8 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-81868 Steeltoe is an open source project that provides a collection of libraries that... |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-76781 A flaw was found in libxml2. |
medium | 5.5 | — | — | 2026-09-17 | 2026-10-30 |
| CVE-2026-75523 Steeltoe is an open source project that provides a collection of libraries that... |
medium | 5.9 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-92880 A weakness has been identified in vgmstream up to r2117. |
medium | 6.3 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-85078 Sanic is an opensource python web server/framework. |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-81447 Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Im... |
medium | 6.8 | — | Dell / openmanage server administrator | 2026-09-17 | 2026-10-06 |
| CVE-2026-63461 Vendure is an open-source headless commerce platform. |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-54471 Dell SmartFabric Manager, versions prior to 2.2.1, contains an Improper Handling... |
medium | 6.5 | — | Dell / smartfabric manager | 2026-09-17 | 2026-10-08 |
| CVE-2026-92973 ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerab... |
medium | 6.1 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-92963 vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-92949 vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to access... |
medium | 4.0 | — | — | 2026-09-17 | 2026-09-21 |
| CVE-2026-92952 vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.js registered intern... |
medium | 6.8 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92945 vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllo... |
medium | 4.2 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92936 vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandbo... |
medium | 5.8 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92879 A security flaw has been discovered in vgmstream up to r2117. |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92933 vm2 is a sandbox for running untrusted Node.js code. |
medium | 5.8 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-81829 A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applicati... |
medium | 5.3 | — | — | 2026-09-17 | 2026-10-09 |
| CVE-2026-81443 Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Ser... |
medium | 6.4 | — | Dell / openmanage server administrator | 2026-09-17 | 2026-10-06 |
| CVE-2026-81453 Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Im... |
medium | 6.5 | — | Dell / openmanage server administrator | 2026-09-17 | 2026-10-06 |
| CVE-2026-78294 Contributor Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions. |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-78528 Unauthenticated Broken Access Control in BerqWP <= 4.1.15 versions. |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-80355 Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Cro... |
medium | 5.4 | — | Dell / openmanage server administrator | 2026-09-17 | 2026-10-06 |
| CVE-2026-74002 Unauthenticated Broken Access Control in Booking Calendar <= 11.7 versions. |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-74005 Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Series <= 3.1.... |
medium | 5.4 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-74017 Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions. |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-73999 Contributor Insecure Direct Object References (IDOR) in Cooked <= 1.16.0 version... |
medium | 5.4 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-74000 Contributor Broken Access Control in Simple Membership <= 4.8.2 versions. |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-71568 In BMCtest, Ironic is started without authentication and TLS for the duration of... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-66676 Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8 versions. |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-66608 Contributor Server Side Request Forgery (SSRF) in Unlimited Elements For Element... |
medium | 6.4 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-66617 Contributor Cross Site Scripting (XSS) in PublishPress Series <= 3.1.3 versions. |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-66575 Unauthenticated Insecure Direct Object References (IDOR) in King Addons for Elem... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-66576 Contributor Cross Site Scripting (XSS) in JetBlocks For Elementor <= 1.5.2 versi... |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-66577 Contributor Cross Site Scripting (XSS) in JetSearch <= 3.6.3 versions. |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-66578 Contributor Cross Site Scripting (XSS) in PropertyHive <= 2.2.6 versions. |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.