September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-91842 A vulnerability has been found in OpenBankProject OBP-API up to 1.10.1. |
medium | 4.1 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-90439 NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-88618 1024-lab SmartAdmin v3.30.0 contains a stored cross-site scripting vulnerability... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-55650 Outerbase Studio is a lightweight browser-based database GUI supporting PostgreS... |
medium | 4.4 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54168 Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in s... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-48722 Nextflow is a DSL for data-driven computational pipelines. |
medium | 5.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-48737 pyLoad is a free and open-source download manager written in Python. |
medium | 4.9 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-48987 pyLoad is a free and open-source download manager written in Python. |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-49446 Cosmos provides users the ability self-host a home server by acting as a secure... |
medium | 6.1 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-25826 An issue was discovered in Keyfactor SignServer before 7.6.0. |
medium | 4.9 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-92077 Denial-of-service in the SVG component. |
medium | 6.5 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92078 Denial-of-service in the Security component. |
medium | 6.5 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92068 Site isolation issue in the Reader Mode component. |
medium | 5.4 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92069 Spoofing issue in the DOM: Navigation component. |
medium | 5.4 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92070 Information disclosure in the Networking component. |
medium | 4.3 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92063 Denial-of-service in the Audio/Video component. |
medium | 6.5 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92039 Mitigation bypass in the DOM: Notifications component. |
medium | 6.3 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92030 Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. |
medium | 5.4 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92031 Information disclosure in the Graphics: ImageLib component. |
medium | 6.5 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92005 Use-after-free in the Audio/Video: Web Codecs component. |
medium | 5.3 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-15609 The Bridge - Creative Multipurpose WordPress Theme theme for WordPress is vulner... |
medium | 6.4 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91997 evolution-api through 2.3.7 contains an incorrect array comparison in the metric... |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-91993 Jpom through 2.11.12 fails to validate workspace ownership when resolving reposi... |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-91994 Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-77117 Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character... |
medium | 5.9 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-80489 Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character en... |
medium | 5.9 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-86472 fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify a... |
medium | 4.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-86818 fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify a... |
medium | 4.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91786 A flaw was found in GNOME Shell. |
medium | 6.1 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91922 Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scriptin... |
medium | 6.1 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-1759 Improper handling of insufficient permissions or privileges vulnerability in Sec... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-59341 A security vulnerability exists in the Sealed Secrets controller's unauthenticat... |
medium | 4.2 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-62280 Open Access Management (OpenAM) is an access management solution. |
medium | 6.1 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2025-5802 The self-registration flow accepts user-supplied input for usernames without ade... |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-91826 Stack-based buffer overflow vulnerability in Samsung Opensource rLottie allows a... |
medium | 4.4 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-91091 A vulnerability was identified in GPAC up to f1219cde. |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-91089 A vulnerability was found in GPAC up to f1219cde. |
medium | 6.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-91086 A security vulnerability has been detected in GPAC up to f1219cde. |
medium | 6.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-91088 A vulnerability has been found in GPAC up to f1219cde. |
medium | 4.8 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-91005 A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. |
medium | 6.3 | — | — | 2026-09-15 | 2026-09-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.