September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-16188 IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to i... |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-15396 IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Serv... |
medium | 6.5 | — | — | 2026-09-14 | 2026-10-22 |
| CVE-2026-15412 IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Serv... |
medium | 6.5 | — | — | 2026-09-14 | 2026-10-22 |
| CVE-2026-15634 IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Serv... |
medium | 6.5 | — | — | 2026-09-14 | 2026-10-22 |
| CVE-2026-15887 IBM WebSphere Application Server 9.0, and 8.5 is affected by blind server-side r... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-15924 Zephyr's TLS socket layer in subsys/net/lib/sockets/sockets_tls.c keeps a single... |
medium | 5.9 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90812 A security vulnerability has been detected in cosmicstack-labs mercury-agent up... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90810 A security flaw has been discovered in cosmicstack-labs mercury-agent up to 1.1.... |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90808 A vulnerability was determined in HKUDS nanobot up to 0.2.1. |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-89020 MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-89021 MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the c... |
medium | 6.9 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-82519 Really Simple Security plugin for WordPress before 9.8.2 contains a missing auth... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-20 |
| CVE-2026-18515 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to plac... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-19543 IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0... |
medium | 6.2 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-18151 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obta... |
medium | 4.2 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-15893 net_if_ipv6_calc_reachable_time() in subsys/net/ip/net_if.c derives a randomized... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-91021 Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site script... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-91081 Docs through 5.6.1 contains a server-side request forgery vulnerability in the c... |
medium | 5.8 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-90807 A vulnerability was found in nanocoai NanoClaw up to 2.1.17. |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90806 A vulnerability has been found in DjangoCRM django-crm up to 1.2. |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-57581 DotVVM is an open source MVVM framework for web applications. |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-57570 backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpa... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-55832 Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolk... |
medium | 6.1 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-55846 Allure 2 is the version 2.x branch of Allure Report, a multi-language test repor... |
medium | 6.2 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-55847 Allure 2 is the version 2.x branch of Allure Report, a multi-language test repor... |
medium | 6.1 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54181 backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpa... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54723 devpi is a Python package index staging server and packaging, testing, and relea... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54176 backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpa... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54177 backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpa... |
medium | 6.6 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-50157 Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-47256 OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability... |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-25 |
| CVE-2026-19542 Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to... |
medium | 5.6 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-90804 A vulnerability was detected in GNU Binutils 2.47. |
medium | 6.1 | — | Gnu / binutils | 2026-09-14 | 2026-09-18 |
| CVE-2026-90796 A vulnerability was identified in itsourcecode Leave Management System 1.0. |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90801 A security flaw has been discovered in GNU Binutils 2.47. |
medium | 6.6 | — | Gnu / binutils | 2026-09-14 | 2026-09-18 |
| CVE-2026-90802 A weakness has been identified in GNU Binutils 2.47. |
medium | 4.4 | — | Gnu / binutils | 2026-09-14 | 2026-09-18 |
| CVE-2026-90803 A security vulnerability has been detected in GNU Binutils 2.47. |
medium | 6.8 | — | Gnu / binutils | 2026-09-14 | 2026-09-18 |
| CVE-2026-57497 webtransport-go is an implementation of the WebTransport protocol. |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-55837 dbt-mcp is a Model Context Protocol server for interacting with dbt. |
medium | 6.8 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-55073 WeasyPrint helps web developers to create PDF documents. |
medium | 6.2 | — | — | 2026-09-14 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.