September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-90600 A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90599 A flaw has been found in Rizwan17 inventory-management-system up to 5e74a46b4b70... |
medium | 4.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90596 A weakness has been identified in embedded-graphics up to 0.8.2 on 32-bit. |
medium | 6.5 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90597 A security vulnerability has been detected in itsourcecode Sales and Inventory S... |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90598 A vulnerability was detected in jaygajera17 E-commerce-project-springBoot up to... |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90595 A security flaw has been discovered in wxiaoqi Spring-Cloud-Platform 1.0/2.2/3.0... |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-89050 The Quads Ads Manager for Google AdSense WordPress plugin before 3.0.5 does not... |
medium | 4.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90584 A weakness has been identified in TooTallNate Java-WebSocket up to 1.6.1. |
medium | 5.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90594 A vulnerability was identified in wxiaoqi Spring-Cloud-Platform 3.0.1/3.1.0. |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-36989 A SQL Injection vulnerability exists in LuxSoft LuxCal through 5.3.4L via rssfee... |
medium | 5.8 | — | — | 2026-09-13 | 2026-09-22 |
| CVE-2026-29812 CyberPanel before 2.4.4 has no logging for actions that could potentially manipu... |
medium | 4.3 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90580 A vulnerability was found in FlowiseAI Flowise up to 3.0.2. |
medium | 6.3 | — | Flowiseai / flowise | 2026-09-13 | 2026-09-16 |
| CVE-2026-90581 A vulnerability was determined in cym1102 nginxWebUI up to 4.4.2. |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90582 A vulnerability was identified in evanchiu serverless-todo 1.0.3/2.0.0. |
medium | 5.3 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90583 A security flaw has been discovered in kagisearch smallweb up to 0ecb9c48edbf98d... |
medium | 4.3 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-29810 CyberPanel before 2.4.4 omits a "return 0" that is required by the business logi... |
medium | 4.3 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90577 A vulnerability was detected in GPAC up to f1219cde. |
medium | 5.3 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90578 A flaw has been found in GPAC up to f1219cde. |
medium | 5.3 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2025-70819 Zettlab D6 Ultra before 1.7.0 allows mounting /etc/passwd and /etc/shadow in a c... |
medium | 6.3 | — | — | 2026-09-13 | 2026-10-18 |
| CVE-2020-15875 An issue was discovered in LibreNMS 1.65. |
medium | 5.0 | — | — | 2026-09-13 | 2026-09-22 |
| CVE-2026-90574 A security flaw has been discovered in itsourcecode Sales and Inventory System 1... |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90572 A vulnerability was determined in davenardella snap7 up to 1.4.3. |
medium | 4.7 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90571 A vulnerability was found in Exrick xmall up to 19e7917d5ed3bd2a2421a3a246ad494c... |
medium | 4.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90565 A security flaw has been discovered in Rizwan17 inventory-management-system up t... |
medium | 5.3 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90527 A vulnerability was detected in quequnlong shiyi-blog up to 1.2.1. |
medium | 4.3 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90525 A weakness has been identified in itsourcecode Sales and Inventory System 1.0. |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-20 |
| CVE-2026-90781 alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_asci... |
medium | 4.4 | — | — | 2026-09-13 | 2026-09-24 |
| CVE-2026-90782 S2OPC through 1.7.3 contains a null pointer dereference in msg_subscription_publ... |
medium | 5.3 | — | — | 2026-09-13 | 2026-09-23 |
| CVE-2026-90520 A vulnerability has been found in jaychouchannel Tourism-Management-System up to... |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-20 |
| CVE-2026-90521 A vulnerability was found in jaychouchannel Tourism-Management-System up to 8122... |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90519 A weakness has been identified in PHPGurukul Bank Locker Management System 1.0. |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90517 A vulnerability was identified in PHPGurukul Bank Locker Management System 1.0. |
medium | 5.3 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90518 A security flaw has been discovered in PHPGurukul Bank Locker Management System... |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90775 PostGIS address_standardizer through 3.7.0 fails to validate the Weight paramete... |
medium | 6.5 | — | — | 2026-09-13 | 2026-09-24 |
| CVE-2026-90511 A vulnerability was detected in GongShengyue OnlineBooks up to dfc5eacc08d3b0396... |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90513 A flaw has been found in simalexan api-lambda-send-email-ses up to bda6869aa8137... |
medium | 6.5 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90767 Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in t... |
medium | 6.5 | — | — | 2026-09-13 | 2026-09-23 |
| CVE-2026-90505 A vulnerability was found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b... |
medium | 5.0 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90506 A vulnerability was determined in vvbbnn00 WARP-Clash-API up to c7bf236007395986... |
medium | 5.0 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90507 A vulnerability was identified in vvbbnn00 WARP-Clash-API up to c7bf236007395986... |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.