September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-90931 LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content dur... |
medium | 5.4 | — | — | 2026-09-14 | 2026-10-29 |
| CVE-2026-90934 EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in th... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-90935 Froxlor before 2.3.7 fails to validate the mysql_server parameter against a cust... |
medium | 4.3 | — | — | 2026-09-14 | 2026-10-08 |
| CVE-2026-90716 A vulnerability was detected in marcobambini Gravity up to 0.9.7. |
medium | 5.5 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90784 A vulnerability has been found in Dvidelabs flatcc up to 0.6.3. |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90927 filebrowser through 2.63.23 fails to limit WebSocket message size in the /api/co... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-90928 File Browser through 2.63.23 contains a memory exhaustion vulnerability in the s... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-90714 A weakness has been identified in marcobambini Gravity up to 0.9.7. |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-78318 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-77147 Improper Control of Generation of Code ('Code Injection') vulnerability in Apach... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-77883 Exposure of sensitive information through data queries vulnerability in Apache S... |
medium | 4.9 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-75015 Insufficiently Protected Credentials vulnerability in Apache Syncope. |
medium | 4.9 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90712 A vulnerability was identified in Gitlawb openclaude up to 0.30.0. |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90709 A security vulnerability has been detected in Yot CMS up to 3.3.1. |
medium | 4.7 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-9812 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.... |
medium | 6.5 | — | Mattermost / mattermost server | 2026-09-14 | 2026-10-06 |
| CVE-2026-90890 ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. |
medium | 5.5 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-90891 ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. |
medium | 5.5 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-90705 A vulnerability was determined in D-Link DWR-M921 1.1.52. |
medium | 6.6 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90706 A vulnerability was identified in D-Link DWR-M921 1.1.52. |
medium | 6.6 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-5132 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.... |
medium | 6.5 | — | Mattermost / mattermost server | 2026-09-14 | 2026-10-07 |
| CVE-2026-12882 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.... |
medium | 4.3 | — | Mattermost / mattermost server | 2026-09-14 | 2026-10-07 |
| CVE-2026-13417 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.... |
medium | 4.3 | — | Mattermost / mattermost server | 2026-09-14 | 2026-10-07 |
| CVE-2026-14259 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.... |
medium | 4.3 | — | Mattermost / mattermost server | 2026-09-14 | 2026-10-07 |
| CVE-2026-14344 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.... |
medium | 4.3 | — | Mattermost / mattermost server | 2026-09-14 | 2026-10-07 |
| CVE-2026-15814 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.... |
medium | 6.5 | — | Mattermost / mattermost server | 2026-09-14 | 2026-10-07 |
| CVE-2026-10542 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.... |
medium | 4.3 | — | Mattermost / mattermost server | 2026-09-14 | 2026-10-07 |
| CVE-2026-10556 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.... |
medium | 5.3 | — | Mattermost / mattermost server | 2026-09-14 | 2026-10-07 |
| CVE-2026-11993 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.... |
medium | 4.3 | — | Mattermost / mattermost server | 2026-09-14 | 2026-10-07 |
| CVE-2026-90704 A vulnerability was found in D-Link DWR-M921 1.1.52. |
medium | 6.6 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-68570 Incorrect Authorization vulnerability in Apache Doris allows an authenticated us... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90697 A vulnerability was identified in SourceCodester Inventory Management System 1.0... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90698 A security flaw has been discovered in memcached 1.6.41/1.6.42/1.6.43. |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90700 A security vulnerability has been detected in itsourcecode Sales and Inventory S... |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-88932 multer is a Node.js middleware for handling multipart/form-data uploads. |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-89321 Publishing limits the compressed size of a VSIX (ovsx.publishing.max-content-siz... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90688 A vulnerability was identified in Tenda W20E 15.11.0.61068_1546_841_CN_TDC. |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-85125 The Android application "YAMAP -Social Trekking GPS App" contains an improper ac... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82790 Cross-site scripting vulnerability exists in PC-HELPER Wireless I/O DIO-0404RY-L... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82792 Cross-site scripting vulnerability exists in Contec CAN 2.0B Communication Wirel... |
medium | 5.2 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82795 SolarView Compact contains a cross-site scripting vulnerability in Schedule Sett... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.