September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92363 A flaw has been found in ag-ui-protocol ag-ui 1.0. |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92364 A vulnerability has been found in itsourcecode Leave Management System 1.0. |
medium | 6.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-92365 A vulnerability was found in vllm-project vllm up to 0.29.0. |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92131 Jenkins Pipeline: Groovy Libraries Plugin 805.va_fc79344957d and earlier does no... |
medium | 4.2 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92132 Jenkins Gradle Plugin 2.19.1252.v15196b_5a_6e10 and earlier requests build scan... |
medium | 5.4 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92133 Jenkins GitLab Plugin 1.2149.vcfc32c82b_f7f and earlier caches the GitLab API cl... |
medium | 5.4 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92138 The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin... |
medium | 4.2 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92139 Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values p... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92140 Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender n... |
medium | 6.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-89029 Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged user... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-89030 Adenion Blog2Social plugin for WordPress before 9.1.0 exposes the email addresse... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-78301 A malformed zone may contain an NS or DNAME node above its origin, which `named`... |
medium | 5.8 | — | — | 2026-09-16 | 2026-10-26 |
| CVE-2026-19941 An inapplicable NSEC record may be accepted by a `named` resolver as proof that... |
medium | 5.9 | — | — | 2026-09-16 | 2026-10-26 |
| CVE-2026-56719 MikroTik RouterOS before 7.24 contains an out-of-bounds read vulnerability in th... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-19662 An attacker may be able to cause a `named` resolver to abort. |
medium | 5.9 | — | — | 2026-09-16 | 2026-10-26 |
| CVE-2026-92360 A weakness has been identified in ag-ui-protocol ag-ui 1.0. |
medium | 6.3 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92361 A security vulnerability has been detected in ag-ui-protocol ag-ui 1.0. |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-28 |
| CVE-2026-92457 yshop-crm through 2.1.3 contains a missing authorization vulnerability in the Cr... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92458 yshop-crm through 2.1.3 contains a missing authorization vulnerability in the St... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92459 yshop-crm through 2.1.3 contains a missing authorization vulnerability in the Cr... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92460 yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92461 yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GE... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92462 yshop-crm through 2.1.3 fails to enforce authorization checks on the CrmFlowCont... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92463 yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92455 yshop-crm through 2.1.3 fails to enforce authorization on the sendSms and sendMa... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92356 A vulnerability was determined in a2ui-project a2ui 0.9/0.9.1. |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-28 |
| CVE-2026-92357 A vulnerability was identified in a2ui-project a2ui 0.8/0.9/1.0. |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-28 |
| CVE-2026-86107 The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when... |
medium | 5.9 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-77190 On affected platforms running Arista EOS, an unauthenticated attacker who is net... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-84439 When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated... |
medium | 5.3 | — | Apache / zookeeper | 2026-09-16 | 2026-09-18 |
| CVE-2026-84501 An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooK... |
medium | 5.3 | — | Apache / zookeeper | 2026-09-16 | 2026-09-18 |
| CVE-2026-73468 A specially crafted packet can cause the premature expiry of multicast forwardin... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-73469 When specific platforms are using Arista EOS with a loose Unicast Reverse Path F... |
medium | 5.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-73436 On affected platforms running Arista EOS with OSPFv2 and OSPFv2 segment routing... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-73438 On affected platforms running Arista EOS with Open Shortest Path First version 3... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-73440 On affected platforms running Arista EOS with Simple Network Management Protocol... |
medium | 4.2 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-19640 On affected platforms running Arista EOS, an authenticated user with access to t... |
medium | 4.2 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-92081 fastify is a fast and low-overhead web framework for Node.js. |
medium | 5.9 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-86465 Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guar... |
medium | 6.5 | — | Apache / apache-airflow-providers-akeyless | 2026-09-16 | 2026-09-17 |
| CVE-2026-82720 NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulner... |
medium | 5.9 | — | Nlnetlabs / unbound | 2026-09-16 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.