September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-91984 Vikunja before 2.6.0 fails to validate that user-supplied project_view_id in tas... |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-91979 Vikunja before 2.6.0 fails to limit archive expansion during data import, allowi... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-91980 vikunja before 2.6.0 fails to validate team access when attaching teams to proje... |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91968 vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91969 vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-91970 Vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91971 Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-ba... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-91966 AVideo through 29.0 contains an unauthenticated server-side request forgery vuln... |
medium | 5.8 | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-91967 AVideo through 29.0 contains a blind server-side request forgery vulnerability i... |
medium | 5.0 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-91960 FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's Stream_Ens... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-91961 FreeRDP before 3.31.0 contains a denial-of-service vulnerability in the URBDRC c... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-23 |
| CVE-2026-91962 FreeRDP before 3.31.0 contains an integer overflow in the audin Apple backends w... |
medium | 6.3 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-23 |
| CVE-2026-91963 FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure v... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-23 |
| CVE-2026-91956 FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the URBDRC... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-91958 FreeRDP versions before 3.31.0 fail to validate MonitorIds array values when par... |
medium | 6.6 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-91959 FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rts_read_... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-91951 FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in t... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-91952 FreeRDP versions before 3.31.0 contain an infinite-loop denial of service in the... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-91953 FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in n... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-91954 FreeRDP before 3.31.0 contains a null pointer dereference vulnerability in gdi_s... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-91950 FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the rdpdr_... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-91946 FreeRDP versions before 3.31.0 contain an information disclosure vulnerability i... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-91942 crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-91944 crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerab... |
medium | 6.1 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-91945 FreeRDP versions before 3.31.0 contain an out-of-bounds read vulnerability in sm... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-91936 Flowise versions before 3.1.4 contain a script injection vulnerability in Docker... |
medium | 6.8 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-91849 A security flaw has been discovered in WuzhiCMS up to 4.1.0. |
medium | 6.3 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-88620 SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorizat... |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-55776 OpenBao is an open source identity-based secrets management system. |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-29 |
| CVE-2026-58196 ToolHive is a utility designed to simplify the deployment and management of Mode... |
medium | 4.7 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-59157 webhookd is a minimalist webhook server that triggers shell scripts and external... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55770 OpenBao is an open source identity-based secrets management system. |
medium | 6.8 | — | — | 2026-09-15 | 2026-09-29 |
| CVE-2026-54724 Kiwi TCMS is an open source test management system. |
medium | 6.1 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55591 Signal K Server is a server application that runs on a central hub in a boat. |
medium | 5.8 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55636 Capsule is a multi-tenancy and policy-based framework for Kubernetes. |
medium | 5.7 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-50024 GitHacker is a tool that restores Git repositories from exposed .git directories... |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-47215 SingularityCE and SingularityPRO are open source container platforms. |
medium | 4.8 | — | — | 2026-09-15 | 2026-09-25 |
| CVE-2026-44163 fluent-plugin-opentelemetry is a Fluentd input and output plugin for forwarding... |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-44282 Decidim is a participatory democracy framework. |
medium | 4.8 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2024-58384 Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPCli... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.