September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-85166 n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential referenc... |
medium | 6.5 | — | N8n / n8n | 2026-09-03 | 2026-10-29 |
| CVE-2026-85156 WWBN AVideo fails to properly validate access controls on the public channel pag... |
medium | 5.3 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85157 WWBN AVideo contains a broken access control vulnerability in the unauthenticate... |
medium | 5.3 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85158 AVideo through commit c91b5975d contains a reflected cross-site scripting vulner... |
medium | 5.4 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85159 AVideo through commit c91b5975d contains a reflected cross-site scripting vulner... |
medium | 5.4 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85100 A vulnerability was detected in 2FastLabs agent-squad up to 1.1.4. |
medium | 4.3 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-85106 A vulnerability has been found in NousResearch hermes-agent 0.18.0. |
medium | 6.3 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-85107 A vulnerability was found in NousResearch hermes-agent 0.18.0. |
medium | 4.3 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-85084 Out-of-bounds Write and Improper Validation of Array Index vulnerability in Sams... |
medium | 6.3 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85089 FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized hea... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-03 | 2026-09-09 |
| CVE-2026-85090 FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the ge... |
medium | 5.4 | — | Freerdp / freerdp | 2026-09-03 | 2026-09-09 |
| CVE-2026-85092 LiME through 1.12.0 fails to validate the disk acquisition output path and does... |
medium | 6.6 | — | — | 2026-09-03 | 2026-09-10 |
| CVE-2026-85093 Cheshire Cat AI's GET /memory/collections/{collection_id}/points endpoint fails... |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-10 |
| CVE-2026-85021 A vulnerability was determined in langgenius dify 1.13.0. |
medium | 4.3 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-85040 A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. |
medium | 4.7 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-82918 XG VisionTerminal, XG-X VisionTerminal, LJ Series Terminal-Software and WI Serie... |
medium | 5.5 | — | — | 2026-09-03 | 2026-10-14 |
| CVE-2026-80253 An improper physical access control issue exists in ShizenBox2 (dev-conf). |
medium | 6.8 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-80254 Authorization bypass through user-controlled key issue exists in ShizenBox2 (edg... |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-74768 Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Server-Si... |
medium | 4.1 | — | Dell / powerprotect data manager | 2026-09-03 | 2026-10-14 |
| CVE-2026-74769 Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain an Incorrec... |
medium | 6.5 | — | Dell / powerprotect data manager | 2026-09-03 | 2026-10-14 |
| CVE-2026-71222 A heap out-of-bounds read vulnerability was found in gfs2-utils. |
medium | 6.3 | — | Redhat / enterprise linux | 2026-09-03 | 2026-09-22 |
| CVE-2026-71224 A stack overflow vulnerability was found in gfs2-utils. |
medium | 4.7 | — | Redhat / enterprise linux | 2026-09-03 | 2026-09-22 |
| CVE-2026-71219 A stack overflow vulnerability was found in gfs2-utils. |
medium | 4.7 | — | Redhat / enterprise linux | 2026-09-03 | 2026-09-22 |
| CVE-2026-68860 Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Reliance... |
medium | 6.8 | — | Dell / powerprotect data manager | 2026-09-03 | 2026-10-14 |
| CVE-2026-3852 The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via th... |
medium | 6.4 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-2573 The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block... |
medium | 6.4 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-17539 RTU500 has a vulnerability, where high-load scenarios, such as sending GI reques... |
medium | 5.9 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2021-43613 An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2021-43614 Error in handling the PlatformLangCodes UEFI variable could cause a buffer overf... |
medium | 6.7 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84885 A vulnerability has been found in simular-ai Agent-S 0.3.1/0.3.2. |
medium | 4.3 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84886 A vulnerability was determined in simular-ai Agent-S up to 0.3.2. |
medium | 5.3 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-84887 A vulnerability was identified in simular-ai Agent-S up to 0.3.2. |
medium | 4.3 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84888 A weakness has been identified in RightNow-AI OpenFang up to 0.6.9. |
medium | 4.3 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84852 A security vulnerability has been detected in Reader Tools PDF Reader App 98.8 o... |
medium | 4.4 | — | — | 2026-09-02 | 2026-09-28 |
| CVE-2026-84856 A vulnerability was detected in rowboatlabs rowboat up to 0.9.1. |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-28 |
| CVE-2026-84857 A flaw has been found in sigoden aichat up to 0.30.4. |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-28 |
| CVE-2026-75137 UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerabil... |
medium | 6.1 | — | — | 2026-09-02 | 2026-09-08 |
| CVE-2026-75134 SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scri... |
medium | 6.4 | — | — | 2026-09-02 | 2026-09-14 |
| CVE-2026-75135 UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerabil... |
medium | 6.1 | — | — | 2026-09-02 | 2026-09-08 |
| CVE-2026-75136 UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulne... |
medium | 6.1 | — | — | 2026-09-02 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.