September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92413 A flaw has been found in Artifex MuPDF up to b6d17493700c621c0e70036980a6ebd06d2... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-88593 kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpo... |
medium | 6.1 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-84397 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-69147 vLLM is an inference and serving engine for large language models. |
medium | 6.5 | — | Vllm / vllm | 2026-09-16 | 2026-10-07 |
| CVE-2026-18120 Concrete CMS before 9.5.3 exposed a legacy Express entry search endpoint that re... |
medium | 5.9 | — | Concretecms / concrete cms | 2026-09-16 | 2026-09-21 |
| CVE-2026-92600 Guns through 8.3.5 contains an information disclosure vulnerability in SysUserCo... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92601 Guns through 8.3.5 contains an improper access control vulnerability in SysNotic... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92603 ContiNew Admin through 4.1.0 contains an authorization bypass vulnerability in t... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92402 A security flaw has been discovered in ChangeWeDer crm up to c07bd4c97141521af64... |
medium | 6.3 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-85732 oras-go is a Go library for managing OCI artifacts. |
medium | 4.7 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-87028 Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted... |
medium | 6.5 | — | Concretecms / concrete cms | 2026-09-16 | 2026-09-21 |
| CVE-2026-84993 MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-85386 Concrete CMS before 9.5.4 did not sanitize XML and XSLT documents uploaded throu... |
medium | 6.1 | — | Concretecms / concrete cms | 2026-09-16 | 2026-09-21 |
| CVE-2026-71181 Dell Update Package Framework, versions prior to 26.07.03, contains an Improper... |
medium | 6.0 | — | Dell / update package framework | 2026-09-16 | 2026-09-21 |
| CVE-2026-71182 Dell Update Package Framework, versions prior to 26.07.03, contains an Improper... |
medium | 6.0 | — | Dell / update package framework | 2026-09-16 | 2026-09-21 |
| CVE-2026-59944 Composer is a dependency Manager for the PHP language. |
medium | 6.1 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-57173 vLLM is an inference and serving engine for large language models. |
medium | 6.5 | — | Vllm / vllm | 2026-09-16 | 2026-10-07 |
| CVE-2026-92615 A flaw was found in flightctl. |
medium | 6.6 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-76104 Dell ObjectScale, versions prior to 4.4.0.0, contains an Incorrect Permission As... |
medium | 5.5 | — | Dell / objectscale | 2026-09-16 | 2026-09-21 |
| CVE-2026-26947 Dell ECS versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior t... |
medium | 6.7 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-19607 A flaw was found in the first-broker-login flow of the keycloak-services compone... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-92567 TDuck survey form through version 5.0 contains an authorization bypass vulnerabi... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92568 MLRun through 1.11.0 contains a server-side request forgery vulnerability in the... |
medium | 5.4 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92569 Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in fo... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92570 reNgine through 2.2.0 contains an authorization bypass vulnerability in the GetF... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92616 FileRise before version 3.28.0 contains a privilege escalation vulnerability tha... |
medium | 6.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-92383 A security vulnerability has been detected in PbootCMS up to 3.2.24. |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-92565 Rallly before 4.15.0 contains an information disclosure vulnerability in the pol... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-89031 Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged user... |
medium | 5.4 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-88976 Plate is a rich-text editor with AI and shadcn/ui. |
medium | 6.1 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-84859 ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Blind S... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-77119 A validly signed NSEC3 from an unrelated sibling zone may be accepted as an inse... |
medium | 5.9 | — | — | 2026-09-16 | 2026-10-26 |
| CVE-2026-77401 Zope AccessControl provides a general security framework for use in Zope. |
medium | 6.8 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-75029 In a query response, an attacker may send `named` multiple copies of a record th... |
medium | 5.3 | — | — | 2026-09-16 | 2026-10-26 |
| CVE-2026-61709 OpenFGA is an authorization and permission engine built for developers. |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-19033 For a secondary zone with transfers restricted by TSIG, `named` may start to ser... |
medium | 6.5 | — | — | 2026-09-16 | 2026-10-26 |
| CVE-2026-19668 A BIND recursive resolver may experience excessive resource consumption if it en... |
medium | 5.3 | — | — | 2026-09-16 | 2026-10-26 |
| CVE-2025-36591 Dell ECS versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior t... |
medium | 4.4 | — | — | 2026-09-16 | 2026-10-14 |
| CVE-2026-92468 zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vu... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92141 Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the r... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.