September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-81052 Dell ThinOS 10, versions prior to 2605_10.2616, contain a Download of Code Witho... |
medium | 6.8 | — | Dell / thinos | 2026-09-10 | 2026-09-16 |
| CVE-2026-88898 AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authorize callers against t... |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88897 Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials throug... |
medium | 5.9 | — | — | 2026-09-10 | 2026-09-15 |
| CVE-2026-88005 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
medium | 6.5 | — | Openwebui / open webui | 2026-09-10 | 2026-09-18 |
| CVE-2026-88006 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
medium | 6.5 | — | Openwebui / open webui | 2026-09-10 | 2026-09-18 |
| CVE-2026-85310 import_contacts Path Traversal in Groundhogg <= 4.7.1 versions. |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-81791 Subscriber Cross Site Scripting (XSS) in EventON <= 2.5.7 versions. |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-81793 Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon... |
medium | 6.5 | — | — | 2026-09-10 | 2026-10-05 |
| CVE-2026-81787 Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 version... |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-81788 Subscriber Broken Access Control in IMPress for IDX Broker <= 3.3.0 versions. |
medium | 6.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-81275 Subscriber Arbitrary File Download in Youzify <= 1.3.7 versions. |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-81782 Subscriber Cross Site Scripting (XSS) in WP Docs <= 2.3.1 versions. |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-81785 Unauthenticated Broken Access Control in BuddyForms <= 2.9.0 versions. |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-78536 Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommer... |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-66632 Unauthenticated Content Injection in Simple Cloudflare Turnstile <= 1.42.1 versi... |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-66674 Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= 1.42.1 ve... |
medium | 5.6 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-15461 The Sierra Wireless HL78xx modem GNSS driver (drivers/modem/hl78xx/, later drive... |
medium | 5.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88896 EspoCRM before 10.0.4 is vulnerable to server-side request forgery. |
medium | 5.3 | — | — | 2026-09-10 | 2026-09-15 |
| CVE-2026-88892 In OpenPanel through 2.3.0, the data importer fetches a caller-supplied URL with... |
medium | 5.0 | — | — | 2026-09-10 | 2026-10-02 |
| CVE-2026-88894 Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company S... |
medium | 5.4 | — | Snipeitapp / snipe-it | 2026-09-10 | 2026-09-29 |
| CVE-2026-88884 Renovate is a dependency update automation tool. |
medium | 5.8 | — | — | 2026-09-10 | 2026-09-29 |
| CVE-2026-88878 Traefik is an HTTP reverse proxy and load balancer. |
medium | 5.3 | — | Traefik / traefik | 2026-09-10 | 2026-10-08 |
| CVE-2026-88871 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master, 202... |
medium | 4.3 | — | — | 2026-09-10 | 2026-09-15 |
| CVE-2026-88875 AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-0... |
medium | 4.3 | — | — | 2026-09-10 | 2026-09-18 |
| CVE-2026-88790 A security vulnerability has been detected in proma-ai Proma up to 0.19.37. |
medium | 4.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88860 Capgo fails to clean up channel permission overrides when a user's last organiza... |
medium | 6.3 | — | — | 2026-09-10 | 2026-09-30 |
| CVE-2026-45763 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
medium | 5.9 | — | Oisf / suricata | 2026-09-10 | 2026-09-28 |
| CVE-2026-12682 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 5.4 | — | — | 2026-09-10 | 2026-09-23 |
| CVE-2026-12683 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 5.4 | — | — | 2026-09-10 | 2026-09-23 |
| CVE-2026-88038 cookies is a Node.js library for reading and writing HTTP cookies, used by Koa v... |
medium | 4.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-9161 Observable response discrepancy vulnerability in DernekPlus Website Template all... |
medium | 5.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-85543 Some Wi-Fi series camera products have insufficient permission validation on cer... |
medium | 4.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-85544 Some Hikvision intercom products utilize an immutable factory value which should... |
medium | 6.1 | — | — | 2026-09-10 | 2026-09-18 |
| CVE-2026-84828 A flaw was found in PCS (Pacemaker Configuration System). |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-14 |
| CVE-2026-88859 A flaw was found in Evolution. |
medium | 6.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-5399 The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 6.4 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-15889 The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site... |
medium | 6.4 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88280 GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser password into a fix... |
medium | 4.9 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88281 GeoVision GV-LPC2211 V1.13 fails to limit repeated Username elements in ONVIF De... |
medium | 4.9 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88283 GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF Create... |
medium | 4.9 | — | — | 2026-09-10 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.