September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86767 Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET... |
medium | 5.0 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-86768 Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpo... |
medium | 5.4 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-86769 Snipe-IT versions before 8.7.0 contain an improper ownership management vulnerab... |
medium | 4.3 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-20 |
| CVE-2026-86772 Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerabili... |
medium | 5.4 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-86764 Snipe-IT through 8.6.4 (fixed in 8.7.0) does not enforce the components.view per... |
medium | 6.5 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-20 |
| CVE-2026-86765 Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assig... |
medium | 6.5 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-86766 Snipe-IT versions up to and including 8.6.3 contain a race condition (TOCTOU) in... |
medium | 6.5 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-86757 Snipe-IT before 8.7.0 fails to properly gate access to encrypted custom-field va... |
medium | 6.5 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-86758 Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate... |
medium | 6.5 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-86760 Snipe-IT versions 8.2.0 through 8.6.x (fixed in 8.7.0) contain an incorrect auth... |
medium | 5.4 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-86761 snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in... |
medium | 4.3 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-86752 snipe-it versions before 8.7.0 fail to enforce per-instance FMCS scoping in asse... |
medium | 5.4 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-14 |
| CVE-2026-86753 snipe-it versions before 8.7.0 fail to validate the requestable flag for asset m... |
medium | 4.3 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-14 |
| CVE-2026-86755 Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered... |
medium | 5.4 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-86756 Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML... |
medium | 6.1 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-86745 Snipe-IT is an IT asset management application. |
medium | 6.5 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-14 |
| CVE-2026-86746 Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire... |
medium | 6.4 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-14 |
| CVE-2026-86747 Snipe-IT is an open source IT asset management system. |
medium | 5.4 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-14 |
| CVE-2026-86748 Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded... |
medium | 6.1 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-14 |
| CVE-2026-86749 Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not check the return value of sto... |
medium | 6.3 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-19 |
| CVE-2026-86739 Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put() when... |
medium | 6.5 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-18 |
| CVE-2026-86742 Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted a... |
medium | 6.5 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-14 |
| CVE-2026-86743 Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report qu... |
medium | 5.0 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-14 |
| CVE-2026-86200 PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability i... |
medium | 5.3 | — | — | 2026-09-09 | 2026-10-08 |
| CVE-2026-86202 PocketMine-MP versions before 5.39.2 contain a network amplification vulnerabili... |
medium | 4.3 | — | — | 2026-09-09 | 2026-10-08 |
| CVE-2026-86204 PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFor... |
medium | 6.5 | — | — | 2026-09-09 | 2026-10-08 |
| CVE-2026-86198 PocketMine-MP versions before 5.44.2 fail to properly validate multiple Resource... |
medium | 4.2 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-79952 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 5.3 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-79964 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 5.3 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-79971 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 5.3 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-14 |
| CVE-2026-78483 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 5.9 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-78486 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 4.4 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-79731 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 4.4 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-14 |
| CVE-2026-73324 Certain VLC media player builds in versions 3.0.0 through 3.0.23 contain a memor... |
medium | 4.3 | — | — | 2026-09-09 | 2026-09-14 |
| CVE-2024-58380 PocketMine-MP versions before 5.11.2 contain a denial of service vulnerability i... |
medium | 6.5 | — | — | 2026-09-09 | 2026-10-27 |
| CVE-2025-71417 PocketMine-MP before 5.32.1 fails to validate uniqueness of pack UUIDs in Resour... |
medium | 6.5 | — | — | 2026-09-09 | 2026-10-19 |
| CVE-2025-71418 PocketMine-MP versions before 5.25.2 fail to limit the explode() function in pac... |
medium | 5.3 | — | — | 2026-09-09 | 2026-10-14 |
| CVE-2023-54392 PocketMine-MP versions >= 4.20.0 before 4.22.3 (and before 5.2.1 in the 5.x bran... |
medium | 6.5 | — | — | 2026-09-09 | 2026-10-08 |
| CVE-2023-54394 PocketMine-MP before 4.18.0-ALPHA2 fails to rate-limit mismatch type InventoryTr... |
medium | 4.3 | — | — | 2026-09-09 | 2026-10-08 |
| CVE-2023-54395 PocketMine-MP versions before 4.12.5 contain a denial-of-service vulnerability i... |
medium | 4.3 | — | — | 2026-09-09 | 2026-10-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.