September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-81237 Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Improper... |
medium | 6.5 | — | Dell / wyse management suite | 2026-09-15 | 2026-09-21 |
| CVE-2026-56830 Shopper is a Headless e-commerce Admin Panel. |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-56831 Shopper is a Headless e-commerce Admin Panel. |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55375 canto-saas-api is a PHP library for interacting with the Canto SaaS API. |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54688 mcp-searxng is a Model Context Protocol server that gives AI assistants web sear... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54689 mcp-searxng is a Model Context Protocol server that gives AI assistants web sear... |
medium | 6.3 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55226 Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55374 canto-saas-api is a PHP library for interacting with the Canto SaaS API. |
medium | 4.8 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-53954 Bugsink is a self-hosted error tracking tool. |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54050 Sakai is a Collaboration and Learning Environment (CLE). |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-25 |
| CVE-2026-48785 Apptainer is an open source container platform. |
medium | 4.8 | — | — | 2026-09-15 | 2026-09-25 |
| CVE-2026-39038 BharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting (... |
medium | 6.1 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-39039 In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authen... |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-39040 BharatMLStack up to and including 1.3.0 is vulnerable to Cross Site Scripting (X... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-12910 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6... |
medium | 5.4 | — | Gitlab / gitlab | 2026-09-15 | 2026-09-28 |
| CVE-2026-12751 IBM Cloud Pak for Business Automation is vulnerable to HTML injection. |
medium | 5.4 | — | Ibm / cloud pak for business automation | 2026-09-15 | 2026-09-23 |
| CVE-2026-12742 IBM Business Automation Workflow containers and traditional could allow an authe... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-12749 IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripti... |
medium | 5.4 | — | Ibm / cloud pak for business automation | 2026-09-15 | 2026-09-23 |
| CVE-2026-12750 IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripti... |
medium | 5.4 | — | Ibm / cloud pak for business automation | 2026-09-15 | 2026-09-23 |
| CVE-2026-11927 IBM Security Verify Identity Access reverse proxy may allow parameters to be inj... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-11864 IBM Cloud Pak for Business Automation 26.0.0 through 26.0.0 Interim Fix 001, 25.... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-11918 IBM ContextForge MCP Gateway <= v1.0.4 IBM mcp-context-forge could allow an auth... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-91854 A vulnerability was identified in code-projects Record Management System 1.0. |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-91855 A security flaw has been discovered in Open5GS up to 2.7.7. |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-79699 A flaw was found in the containers/storage library. |
medium | 4.4 | — | — | 2026-09-15 | 2026-10-02 |
| CVE-2026-79705 A flaw was found in the buildah/copier Go package. |
medium | 4.5 | — | — | 2026-09-15 | 2026-10-30 |
| CVE-2026-81894 Concrete CMS 9.5.2 and below is vulnerable to stored DOM-based Cross-site Script... |
medium | 5.4 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-22 |
| CVE-2026-81896 Concrete CMS before 9.5.3 does not apply HTML entity encoding to user-defined Fo... |
medium | 5.4 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-22 |
| CVE-2026-81897 In Concrete CMS below CMS 9.5.3, the save_control action in the Express entities... |
medium | 5.4 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-22 |
| CVE-2026-55863 motionEye (mEye) is an online interface for a piece of software called "motion,"... |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54503 plone.app.textfield provides a zope.schema-style field type called RichText for... |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54561 MCP Memory Keeper is an MCP server for persistent context management in AI codin... |
medium | 6.2 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-18111 Concrete CMS 9 before 9.5.3 was vulnerable to stored cross-site scripting (XSS)... |
medium | 6.1 | — | Concretecms / concrete cms | 2026-09-15 | 2026-10-15 |
| CVE-2026-91991 Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection t... |
medium | 5.4 | — | — | 2026-09-15 | 2026-10-08 |
| CVE-2026-91992 Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPCl... |
medium | 5.9 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-91986 gitoxide gix-transport before 0.59.2 fails to filter control characters in git-d... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-91987 atomic-agents-stack before 1.1.0 contains a cost-guardrail bypass in the _estima... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-91981 Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the... |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-91982 Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enroll... |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-91983 Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task re... |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.