September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-49837 GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go P... |
medium | 5.9 | — | — | 2026-09-10 | 2026-09-16 |
| CVE-2026-49838 GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go P... |
medium | 5.9 | — | — | 2026-09-10 | 2026-09-16 |
| CVE-2026-54054 Transmute is a free, open-source, self-hosted file conversion and compression to... |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-30 |
| CVE-2026-45767 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
medium | 4.4 | — | Oisf / suricata | 2026-09-10 | 2026-09-16 |
| CVE-2026-36392 FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting (XSS). |
medium | 5.4 | — | — | 2026-09-10 | 2026-09-22 |
| CVE-2026-9225 IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated atta... |
medium | 6.5 | — | Langflow / langflow | 2026-09-10 | 2026-09-15 |
| CVE-2026-9667 IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side reque... |
medium | 5.3 | — | Ibm / websphere application server | 2026-09-10 | 2026-09-15 |
| CVE-2026-89089 A SQL injection vulnerability exists in the JasperReports-based reporting featur... |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-18 |
| CVE-2026-3096 The product's web portals allow external links to be opened in a new browser tab... |
medium | 4.7 | — | — | 2026-09-10 | 2026-09-18 |
| CVE-2026-45752 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
medium | 5.9 | — | Oisf / suricata | 2026-09-10 | 2026-09-28 |
| CVE-2026-19596 An XML External Entity (XXE) vulnerability exists in the XML collector of multip... |
medium | 5.9 | — | — | 2026-09-10 | 2026-09-18 |
| CVE-2022-26962 Italtel NFV 11.1.2-20210318 allows Multiple Stored XSS under NP_BCCAS-RMCTRL-01/... |
medium | 5.4 | — | — | 2026-09-10 | 2026-09-22 |
| CVE-2026-88060 Angular is a development platform for building mobile and desktop web applicatio... |
medium | 6.1 | — | Angular / angular | 2026-09-10 | 2026-09-29 |
| CVE-2026-9338 IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of servi... |
medium | 5.3 | — | Ibm / websphere application server | 2026-09-10 | 2026-09-16 |
| CVE-2026-88057 Angular is a development platform for building mobile and desktop web applicatio... |
medium | 6.1 | — | Angular / angular | 2026-09-10 | 2026-09-29 |
| CVE-2026-88058 Angular is a development platform for building mobile and desktop web applicatio... |
medium | 6.1 | — | Angular / angular | 2026-09-10 | 2026-09-29 |
| CVE-2026-88059 Angular is a development platform for building mobile and desktop web applicatio... |
medium | 5.8 | — | Angular / angular | 2026-09-10 | 2026-09-29 |
| CVE-2026-88035 A size check in the client-side authentication path of the MongoDB C Driver can... |
medium | 5.5 | — | Mongodb / c driver | 2026-09-10 | 2026-09-16 |
| CVE-2026-87106 Consul and Consul Enterprise are vulnerable to a denial of service in the native... |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-87107 Consul and Consul Enterprise are vulnerable to an authorization bypass in the ca... |
medium | 5.4 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-89044 Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.... |
medium | 6.5 | — | Netty / netty | 2026-09-10 | 2026-09-18 |
| CVE-2026-89045 zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length para... |
medium | 4.0 | — | — | 2026-09-10 | 2026-09-15 |
| CVE-2026-88054 Tesseract is an open source OCR engine. |
medium | 5.5 | — | Tesseract-ocr / tesseract ocr | 2026-09-10 | 2026-09-16 |
| CVE-2026-88055 AnythingLLM is an application that turns pieces of content into context that any... |
medium | 5.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88028 Improper neutralization of special elements in data query logic in the polymorph... |
medium | 6.5 | — | Mongodb / laravel mongodb | 2026-09-10 | 2026-09-29 |
| CVE-2026-88026 Improper neutralization of regular-expression metacharacters in the LINQ query t... |
medium | 6.5 | — | Mongodb / c\# driver | 2026-09-10 | 2026-09-29 |
| CVE-2026-88049 Tesseract is an open source OCR engine. |
medium | 5.5 | — | Tesseract-ocr / tesseract ocr | 2026-09-10 | 2026-09-14 |
| CVE-2026-88050 Tesseract is an open source OCR engine. |
medium | 5.5 | — | Tesseract-ocr / tesseract ocr | 2026-09-10 | 2026-09-14 |
| CVE-2026-88046 rclone is a command-line program to sync files and directories to and from diffe... |
medium | 5.3 | — | — | 2026-09-10 | 2026-09-15 |
| CVE-2026-52097 An issue in AppFlowy 0.11.8 allows a remote attacker to execute arbitrary code v... |
medium | 6.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88938 knowns through 0.33.0 fails to confine the path argument of the code.find MCP to... |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-88940 knowns through 0.33.0 fails to validate the path query parameter in the workspac... |
medium | 5.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88012 Traefik is an open source HTTP reverse proxy and load balancer. |
medium | 5.3 | — | Traefik / traefik | 2026-09-10 | 2026-09-14 |
| CVE-2026-88013 rclone is a command-line program to sync files and directories to and from diffe... |
medium | 5.3 | — | Rclone / rclone | 2026-09-10 | 2026-09-23 |
| CVE-2026-88014 rclone is a command-line program to sync files and directories to and from diffe... |
medium | 6.3 | — | Rclone / rclone | 2026-09-10 | 2026-09-23 |
| CVE-2026-88015 rclone is a command-line program to sync files and directories to and from diffe... |
medium | 5.3 | — | Rclone / rclone | 2026-09-10 | 2026-09-23 |
| CVE-2026-87912 A missing S3 bucket ownership verification in the AWS Security Agent plugin in A... |
medium | 5.9 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-87913 A missing S3 bucket ownership verification in the AWS Security Agent MCP server... |
medium | 5.9 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-81049 Dell ThinOS 10, versions prior to 2605_10.2616, contain a Missing Support for In... |
medium | 6.7 | — | Dell / thinos | 2026-09-10 | 2026-09-16 |
| CVE-2026-81051 Dell ThinOS 10, versions prior to 2605_10.2616, contain a Security Version Numbe... |
medium | 6.6 | — | Dell / thinos | 2026-09-10 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.