September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-82796 SolarView Compact contains a cross-site scripting vulnerability in Image Managem... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82783 Plaintext storage of a password issue exists in CONPROSYS nano Series . |
medium | 4.2 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82784 Missing authentication for critical function vulnerability exists in Remote I/O... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82785 Stack-based buffer overflow vulnerability exists in Remote I/O Coupler Unit (Ser... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82786 Insufficiently protected credentials issue exists in Remote I/O Coupler Unit (Se... |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82788 Cross-site scripting vulnerability exists in CPSL-08P1EN. |
medium | 6.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82776 Cross-site scripting vulnerability exists in CONPROSYS PAC Series. |
medium | 6.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82778 An exposure of information through directory listing issue exists in CONPROSYS P... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82781 Cross-site scripting vulnerability exists in CONPROSYS nano Series. |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82782 Out-of-bounds write vulnerability exists in CONPROSYS nano Series. |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82769 Cross-site scripting vulnerability exists in Contec RP-WAH-SR Series. |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82771 Cross-site scripting vulnerability exists in Contec EC1000 series. |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82773 Cross-site scripting vulnerability exists in CONPROSYS M2M Gateway Series and CO... |
medium | 6.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82775 An exposure of information through directory listing issue exists in CONPROSYS M... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82763 Cross-site scripting vulnerability exists in Contec FX5000 series, FX4000 series... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82764 Cross-site request forgery vulnerability exists in multiple Contec products. |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-82767 Cross-site scripting vulnerability exists in SGA1000. |
medium | 5.2 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2024-23176 An issue was discovered in the MassMessage extension in MediaWiki before 1.40.2. |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-28 |
| CVE-2023-50459 An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-50460 An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-50462 An issue was discovered in the content_consent (aka Content Consent) extension t... |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-51769 Frappe before 14.49.0 allows an XSS attack that is associated with blog pages an... |
medium | 6.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90686 A vulnerability was found in GPAC up to f1219cde. |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90687 A vulnerability was determined in GPAC up to f1219cde. |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2023-40772 A directory Traversal vulnerability in DataEase before 1.18.10 allows a remote a... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-45023 The femanager extension 7 before 7.2.2 for TYPO3 has Incorrect Access Control: i... |
medium | 4.2 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-46035 The svg_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrust... |
medium | 5.9 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-90682 A security vulnerability has been detected in Matthias-Wandel jhead up to 3.3. |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2023-34854 HotelDruid before 3.0.6 has insufficient file upload sanitation in the backup/re... |
medium | 6.6 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-29377 An issue was discovered in Softing OPC UA C++ SDK through 6.20 and Softing Secur... |
medium | 6.6 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-90621 A vulnerability was identified in ipa-lab HackingBuddyGPT up to 0.5.0. |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90615 A security vulnerability has been detected in SourceCodester Class and Exam Time... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90614 A weakness has been identified in FedML-AI FedML up to 0.9.6. |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-33957 An issue was discovered in CustOS Driver in Samsung Mobile Processor Exynos 1580... |
medium | 4.2 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-33964 An issue was discovered in camera in Samsung Mobile Processor Exynos 1580 and 25... |
medium | 6.4 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-23788 An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, an... |
medium | 4.2 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-23790 An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 13... |
medium | 4.2 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-23791 An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 13... |
medium | 4.2 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-23792 An issue was discovered in NR RRC in Samsung Mobile Processor and Modem Exynos 1... |
medium | 4.0 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2025-68624 N-able Mail Assure through April 2026 contains a design-level authorization flaw... |
medium | 4.3 | — | — | 2026-09-14 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.