September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-53496 ExifReader is a JavaScript Exif information parser. |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-15923 The Zephyr SDIO subsystem function sdio_io_rw_extended_helper() in subsys/sd/sdi... |
medium | 4.6 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90994 A flaw was found in sssd, specifically within the PAM (Pluggable Authentication... |
medium | 4.0 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90995 A flaw was found in SSSD (System Security Services Daemon). |
medium | 5.5 | — | Fedoraproject / sssd | 2026-09-14 | 2026-10-14 |
| CVE-2026-90996 A flaw was found in sssd. |
medium | 5.5 | — | Fedoraproject / sssd | 2026-09-14 | 2026-10-07 |
| CVE-2026-90793 A vulnerability has been found in GPAC up to f1219cde. |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90794 A vulnerability was found in GPAC up to f1219cde. |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90795 A vulnerability was determined in itsourcecode Loan Management System 1.0. |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90792 A flaw has been found in GPAC up to f1219cde. |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90463 A flaw was found in the sssd NSS responder. |
medium | 4.0 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-54529 SQLAdmin is a flexible Admin interface for SQLAlchemy models. |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-55235 langgraph-api implements the LangGraph API for rapid development and testing. |
medium | 5.9 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-55236 langgraph-api implements the LangGraph API for rapid development and testing. |
medium | 5.9 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-4103 Insufficient HTML sanitization in the Publisher Portal and Developer Portal allo... |
medium | 6.4 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-53708 ContextForge is an AI gateway, registry, and proxy that provides centralized dis... |
medium | 6.6 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2025-24890 gitoxide is an implementation of git written in Rust. |
medium | 6.8 | — | — | 2026-09-14 | 2026-10-14 |
| CVE-2026-90790 A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90791 A vulnerability was detected in GPAC up to f1219cde. |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-82433 Description
`getNimbusConf` returned the complete daemon configuration without... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-82434 Description
When ZooKeeper authentication is configured, Storm deliberately ret... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-82437 Description
The Logviewer offers `logs.users` and `logs.groups` so operators ca... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-82019 TripleLift's ad rendering script (video-bundle.js) contains a DOM-based cross-si... |
medium | 4.2 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-82426 Description
Nimbus accepted the `uploadedJarLocation` argument of `submitTopolo... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-57128 PraisonAI is a multi-agent teams system. |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-57115 PraisonAI is a multi-agent teams system. |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-57120 PraisonAI is a multi-agent teams system. |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90939 novel-plus through 5.3.3 contains an information disclosure vulnerability in the... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-90940 novel-plus through 5.3.3 contains an insecure default cache-management password... |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-90941 novel-plus through 5.3.3 contains an authorization bypass vulnerability in the B... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-90785 A vulnerability was found in Dvidelabs flatcc up to 0.6.3. |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90786 A vulnerability was determined in Dvidelabs flatcc up to 0.6.3. |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90788 A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055. |
medium | 4.7 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-86348 Mattermost versions <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from... |
medium | 4.3 | — | Mattermost / mattermost server | 2026-09-14 | 2026-10-14 |
| CVE-2026-86349 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.8, 10.11.... |
medium | 4.3 | — | Mattermost / mattermost server | 2026-09-14 | 2026-10-07 |
| CVE-2026-82920 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 fail to... |
medium | 5.5 | — | Mattermost / mattermost server | 2026-09-14 | 2026-10-07 |
| CVE-2026-84179 Description
getTopologyPageInfo merged the Nimbus daemon configuration with the... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-7208 Yealink SIP-T33G firmware versions 124.86.x.x prior to 124.87.0.0 contain a race... |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-73191 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Sync... |
medium | 6.1 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90936 Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current... |
medium | 4.3 | — | — | 2026-09-14 | 2026-10-08 |
| CVE-2026-90930 File Browser through 2.63.23 applies path rules to the requested lexical path bu... |
medium | 6.8 | — | — | 2026-09-14 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.