September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-85701 A vulnerability has been found in ramon-victor freegpt-webui up to 098db3dfeb415... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85703 A flaw has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca926... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-11 |
| CVE-2026-53769 Avo is a framework to create admin panels for Ruby on Rails apps. |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-30 |
| CVE-2026-77847 Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a us... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2022-26961 Italtel NetMatch-S 5.0.0-20200703 allows Multiple Stored XSS under NP_IBCF-NATUP... |
medium | 5.4 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-85643 A flaw has been found in code-projects Online Shopping System 1.0. |
medium | 4.7 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-55512 nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-55513 nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. |
medium | 5.4 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85637 A security flaw has been discovered in jofpin trape 1.0.0/2.0. |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85639 A security vulnerability has been detected in jofpin trape 2.0. |
medium | 5.6 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-80115 PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 10... |
medium | 6.1 | — | — | 2026-09-04 | 2026-09-14 |
| CVE-2026-85769 A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85636 A vulnerability was identified in jofpin trape 1.0.0. |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-84890 undici's decompress interceptor decompresses response bodies according to the un... |
medium | 5.9 | — | Nodejs / undici | 2026-09-04 | 2026-09-11 |
| CVE-2026-57166 PJSIP is a free and open source multimedia communication library written in C. |
medium | 5.3 | — | Teluu / pjsip | 2026-09-04 | 2026-09-11 |
| CVE-2026-61608 SolidInvoice is an open-source invoicing platform. |
medium | 6.8 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-61614 SolidInvoice is an open-source invoicing platform. |
medium | 5.9 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-61688 SolidInvoice is an open-source invoicing platform. |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-57164 PJSIP is a free and open source multimedia communication library written in C. |
medium | 5.9 | — | Teluu / pjsip | 2026-09-04 | 2026-09-11 |
| CVE-2026-57165 PJSIP is a free and open source multimedia communication library written in C. |
medium | 5.3 | — | Teluu / pjsip | 2026-09-04 | 2026-09-11 |
| CVE-2026-57160 PJSIP is a free and open source multimedia communication library written in C. |
medium | 5.3 | — | Teluu / pjsip | 2026-09-04 | 2026-09-11 |
| CVE-2026-53756 Emlog is an open source website building system. |
medium | 4.9 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-53760 Admidio is an open-source user management solution. |
medium | 5.2 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-18149 undici's retry handler can leave an already-exposed response body pending foreve... |
medium | 5.9 | — | Nodejs / undici | 2026-09-04 | 2026-09-16 |
| CVE-2026-84947 undici's dump interceptor reads and discards a response body up to a configurabl... |
medium | 5.3 | — | Nodejs / undici | 2026-09-04 | 2026-09-15 |
| CVE-2026-85008 undici's cache interceptor documents that only safe HTTP methods are cached, but... |
medium | 5.3 | — | Nodejs / undici | 2026-09-04 | 2026-09-15 |
| CVE-2026-85024 undici bundles a WebSocket client whose permessage-deflate size-limit cleanup re... |
medium | 5.9 | — | Nodejs / undici | 2026-09-04 | 2026-09-16 |
| CVE-2026-78849 Cross Site Scripting vulnerability in Netgate pfSense Plus software versions <=... |
medium | 5.4 | — | — | 2026-09-04 | 2026-09-14 |
| CVE-2026-38961 Cross-Site Scripting (XSS) vulnerability in the RSS Widget of Netgate pfSense Pl... |
medium | 5.4 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-17621 IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote attacker to traverse... |
medium | 5.4 | — | Langflow / langflow | 2026-09-04 | 2026-09-10 |
| CVE-2026-17622 IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacke... |
medium | 6.5 | — | Langflow / langflow | 2026-09-04 | 2026-09-09 |
| CVE-2026-17631 IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacke... |
medium | 6.5 | — | Langflow / langflow | 2026-09-04 | 2026-09-09 |
| CVE-2026-18073 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to injec... |
medium | 4.4 | — | Ibm / i | 2026-09-04 | 2026-09-08 |
| CVE-2026-18076 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to caus... |
medium | 6.5 | — | Ibm / i | 2026-09-04 | 2026-09-10 |
| CVE-2026-18078 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to caus... |
medium | 6.5 | — | Ibm / i | 2026-09-04 | 2026-09-08 |
| CVE-2026-17442 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.... |
medium | 5.5 | — | Ibm / app connect enterprise | 2026-09-04 | 2026-09-10 |
| CVE-2026-17443 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.... |
medium | 6.5 | — | Ibm / app connect enterprise | 2026-09-04 | 2026-09-09 |
| CVE-2026-17444 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.... |
medium | 6.5 | — | Ibm / app connect enterprise | 2026-09-04 | 2026-09-10 |
| CVE-2026-17469 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause... |
medium | 5.5 | — | Ibm / i | 2026-09-04 | 2026-09-09 |
| CVE-2026-17259 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to caus... |
medium | 6.5 | — | Ibm / i | 2026-09-04 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.