September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84857 A flaw has been found in sigoden aichat up to 0.30.4. |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-28 |
| CVE-2026-75137 UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerabil... |
medium | 6.1 | — | — | 2026-09-02 | 2026-09-08 |
| CVE-2026-75134 SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scri... |
medium | 6.4 | — | — | 2026-09-02 | 2026-09-14 |
| CVE-2026-75135 UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerabil... |
medium | 6.1 | — | — | 2026-09-02 | 2026-09-08 |
| CVE-2026-75136 UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulne... |
medium | 6.1 | — | — | 2026-09-02 | 2026-09-08 |
| CVE-2026-84839 A vulnerability was determined in tsi-coop tsi-dpdp-cms up to 0.5.0. |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84840 A vulnerability was identified in tsi-coop tsi-dpdp-cms up to 0.5.0. |
medium | 6.5 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84833 A vulnerability was found in ntegrals openbrowser up to 067fc45d649baa961750da8e... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84378 HTTPX2 is a next generation HTTP client for Python. |
medium | 5.9 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-84379 HTTPX2 is a next generation HTTP client for Python. |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-84380 HTTPX2 is a next generation HTTP client for Python. |
medium | 5.6 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-84377 LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) fo... |
medium | 6.5 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-82522 libjxl before 0.12 contains an integer underflow vulnerability in the container... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-23 |
| CVE-2026-77123 Nexus Repository 3 contains a sensitive information disclosure vulnerability in... |
medium | 6.5 | — | Sonatype / nexus repository manager | 2026-09-02 | 2026-09-22 |
| CVE-2026-77121 A user account with permission to deploy artifacts to a hosted Maven repository... |
medium | 6.5 | — | Sonatype / nexus repository manager | 2026-09-02 | 2026-10-07 |
| CVE-2026-77122 An authorization flaw in the REST API repository details endpoint (GET /service/... |
medium | 4.3 | — | Sonatype / nexus repository manager | 2026-09-02 | 2026-09-22 |
| CVE-2026-55221 Boruta is a standalone authorization server that aims to implement OAuth 2.0 and... |
medium | 6.5 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-49830 DSpace open source software is a repository application which provides durable a... |
medium | 4.4 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-49831 DSpace open source software is a repository application which provides durable a... |
medium | 5.5 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-49833 DSpace open source software is a repository application which provides durable a... |
medium | 5.5 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-84809 Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode... |
medium | 6.5 | — | — | 2026-09-02 | 2026-09-24 |
| CVE-2026-84810 claude-skill-antivirus fails to analyze executable files when scanning local ski... |
medium | 6.5 | — | — | 2026-09-02 | 2026-09-23 |
| CVE-2026-84811 agentverus-scanner fails to analyze compiled Python bytecode files in companion... |
medium | 6.5 | — | — | 2026-09-02 | 2026-09-23 |
| CVE-2026-55421 Open edX Platform enables the authoring and delivery of online learning at any s... |
medium | 6.8 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-52832 Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. |
medium | 4.9 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-53636 Open edX Platform enables the authoring and delivery of online learning at any s... |
medium | 4.7 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-20355 Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/... |
medium | 5.9 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-20354 Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/... |
medium | 5.9 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84674 Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earli... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84676 Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unen... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84677 Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84664 Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab co... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84666 Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier allows... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-84654 In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, inc... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84655 Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when... |
medium | 4.3 | — | Jenkins / jenkins | 2026-09-02 | 2026-09-15 |
| CVE-2026-84656 A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier... |
medium | 4.3 | — | Jenkins / jenkins | 2026-09-02 | 2026-09-15 |
| CVE-2026-84657 In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command doe... |
medium | 4.2 | — | Jenkins / jenkins | 2026-09-02 | 2026-09-15 |
| CVE-2026-84658 Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBo... |
medium | 4.3 | — | Jenkins / script security | 2026-09-02 | 2026-09-22 |
| CVE-2026-84659 Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce... |
medium | 4.3 | — | Jenkins / script security | 2026-09-02 | 2026-09-22 |
| CVE-2026-84660 A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_1... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-03 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.