September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87012 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
medium | 4.3 | — | Openwebui / open webui | 2026-09-09 | 2026-09-15 |
| CVE-2026-87013 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
medium | 4.3 | — | Openwebui / open webui | 2026-09-09 | 2026-09-15 |
| CVE-2026-87014 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
medium | 6.5 | — | Openwebui / open webui | 2026-09-09 | 2026-09-15 |
| CVE-2026-87015 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
medium | 6.8 | — | Openwebui / open webui | 2026-09-09 | 2026-09-15 |
| CVE-2026-79387 SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an a... |
medium | 4.3 | — | — | 2026-09-09 | 2026-09-14 |
| CVE-2026-79513 A divide-by-zero vulnerability in the gf_dash_get_timeline_duration function (sr... |
medium | 6.5 | — | Gpac / gpac | 2026-09-09 | 2026-09-15 |
| CVE-2026-79514 An out-of-bounds read in the gf_dm_data_received function (downloader.c) of GPAC... |
medium | 6.5 | — | Gpac / gpac | 2026-09-09 | 2026-09-15 |
| CVE-2026-79515 An out-of-bounds read in the stbtt_GetGlyphShape component of nothings stb commi... |
medium | 4.3 | — | — | 2026-09-09 | 2026-09-14 |
| CVE-2026-79516 An out-of-bounds read in the stbsp_vsnprintf function (stb_sprintf.h) of nothing... |
medium | 4.0 | — | — | 2026-09-09 | 2026-09-14 |
| CVE-2026-79522 An out-of-bounds read in the gf_dm_get_chunk_data function (src/utils/downloader... |
medium | 6.5 | — | Gpac / gpac | 2026-09-09 | 2026-09-15 |
| CVE-2026-53956 Rattler is a library that provides common functionality used within the conda ec... |
medium | 5.4 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-71802 A stored Cross-Site Scripting (XSS) vulnerability exists in the announcement pre... |
medium | 5.4 | — | — | 2026-09-09 | 2026-09-14 |
| CVE-2026-71803 money-pos 1.0 contains a stored Cross-Site Scripting (XSS) vulnerability. |
medium | 5.4 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-73788 A vulnerability in the ClearPass OnGuard agent could allow an authenticated remo... |
medium | 6.5 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-73789 A vulnerability in the web-based management interface of CPPM guest account mana... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-71616 An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to... |
medium | 6.2 | — | — | 2026-09-09 | 2026-09-14 |
| CVE-2026-61908 An issue was discovered in Cyrus IMAP before 3.12.4. |
medium | 6.5 | — | Cyrus / imap | 2026-09-09 | 2026-09-16 |
| CVE-2026-61909 An issue was discovered in Cyrus IMAP before 3.12.4. |
medium | 4.3 | — | Cyrus / imap | 2026-09-09 | 2026-09-16 |
| CVE-2026-61910 An issue was discovered in Cyrus IMAP before 3.12.4. |
medium | 5.0 | — | Cyrus / imap | 2026-09-09 | 2026-09-16 |
| CVE-2026-61911 An issue was discovered in Cyrus IMAP before 3.12.4. |
medium | 4.3 | — | Cyrus / imap | 2026-09-09 | 2026-09-16 |
| CVE-2026-38998 A use-after-free in the SocketDescriptor::tcpReadHandler1 function (liveMedia/RT... |
medium | 6.5 | — | — | 2026-09-09 | 2026-09-14 |
| CVE-2026-61907 An issue was discovered in Cyrus IMAP before 3.12.4. |
medium | 4.3 | — | — | 2026-09-09 | 2026-09-14 |
| CVE-2026-39020 An issue in WIngs3D v.2.4.1 allows a local attacker to cause a denial of service... |
medium | 5.5 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2025-51619 A vulnerability in the Thesycon DPC Latency Checker driver (dpc.sys) thru 1.4.0... |
medium | 5.5 | — | — | 2026-09-09 | 2026-10-19 |
| CVE-2026-87875 The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length... |
medium | 4.3 | — | — | 2026-09-09 | 2026-10-21 |
| CVE-2026-87928 MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerabi... |
medium | 5.4 | — | — | 2026-09-09 | 2026-09-18 |
| CVE-2026-87872 A flaw was found in the OCAPI modules (ocapi_command, ocapi_info) of the
communi... |
medium | 6.8 | — | — | 2026-09-09 | 2026-09-14 |
| CVE-2026-85788 Incomplete list of disallowed inputs in the mutable SQL detector component in Am... |
medium | 5.5 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-70425 Dell PowerScale OneFS, Versions 9.5.0.0 through 9.7.1.0, Versions 9.8.0.0 throug... |
medium | 6.7 | — | Dell / powerscale onefs | 2026-09-09 | 2026-09-16 |
| CVE-2026-40635 Dell PowerScale OneFS versions 9.12.0.0 through 9.13.1.0 contain an Insecure Tem... |
medium | 5.4 | — | Dell / powerscale onefs | 2026-09-09 | 2026-09-16 |
| CVE-2026-81330 The C6 ear camera transmits live video to the EarVision Android application over... |
medium | 6.5 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-79741 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 5.3 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-11 |
| CVE-2026-79945 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 5.5 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-11 |
| CVE-2026-79946 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 5.3 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-14 |
| CVE-2026-79947 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 5.5 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-79735 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 4.4 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-83530 A user could provide an expression whose string length is longer than the Parser... |
medium | 4.3 | — | Google / common expression language | 2026-09-09 | 2026-09-23 |
| CVE-2026-82530 IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an acces... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-86773 Snipe-IT through version 8.6.3 fails to perform object-level authorization in th... |
medium | 5.4 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-86774 Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in... |
medium | 6.3 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-20 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.