September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-54872 Issue summary: The generic elliptic-curve scalar multiplication used for
ECDSA a... |
low | 3.7 | — | Openssl / openssl | 2026-09-29 | 2026-10-08 |
| CVE-2026-54875 Issue summary: A non-constant-time optimized implementation of scalar
point mult... |
low | 3.7 | — | Openssl / openssl | 2026-09-29 | 2026-10-08 |
| CVE-2026-35191 Issue summary: The OpenSSL QUIC server, when configured to not preform address
v... |
low | 3.7 | — | Openssl / openssl | 2026-09-29 | 2026-10-08 |
| CVE-2026-102601 Flysystem is an open source file storage library for PHP. |
low | 3.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-4523 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11... |
low | 3.7 | — | Gitlab / gitlab | 2026-09-29 | 2026-10-05 |
| CVE-2026-102264 A vulnerability was found in mwasikz robo-cafe-rms up to 228c44a02823f04e85db32b... |
low | 3.5 | — | — | 2026-09-29 | 2026-10-02 |
| CVE-2026-102290 A vulnerability was determined in CodeCanyon Rocket LMS up to 2.2. |
low | 3.5 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102414 pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on... |
low | 3.7 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102241 A vulnerability was determined in Netcore NAP930 0.1.241010.141410. |
low | 2.7 | — | — | 2026-09-29 | 2026-10-01 |
| CVE-2026-102363 mall4j through 4.0 contains a missing authentication vulnerability in the Delive... |
low | 3.7 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-101265 A vulnerability was identified in Intelbras TIP 125i 4.3.35/4.3.41. |
low | 3.1 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-97027 Flatpak passes through arbitrary vendor-extension keys unmodified when exporting... |
low | 3.6 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-97025 Flatpak writes the OCI repository authentication token with world-readable permi... |
low | 3.2 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-97026 Flatpak creates temporary child repository directories under the user cache with... |
low | 3.9 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-102279 Laravel is a web application framework. |
low | 3.1 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101915 @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, wi... |
low | 3.7 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101141 A flaw has been found in Eleveo Call Recording Software 9.7.0. |
low | 3.5 | — | — | 2026-09-28 | 2026-10-20 |
| CVE-2026-101131 A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.5-rc.3. |
low | 3.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101132 A security flaw has been discovered in DeepSeek deepseek-harness up to 0.1.7-rc.... |
low | 3.1 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101139 A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. |
low | 2.7 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-97399 The strncasecmp function in the GNU C Library 2.24 and later optimized for the P... |
low | 3.7 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-101079 A vulnerability was found in agentverus agentverus-scanner up to 0.8.1. |
low | 2.8 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101333 A flaw was found in the Micrometer user-event metrics listener of Keycloak, a so... |
low | 3.7 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100904 A security vulnerability has been detected in amirsanni mini-inventory-and-sales... |
low | 3.5 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-96284 A malicious user can get read-access to files in the flatpak-system-helper conte... |
low | 2.5 | — | — | 2026-09-27 | 2026-09-29 |
| CVE-2026-100882 A vulnerability was detected in Krayin laravel-crm up to 2.2.5. |
low | 2.4 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-96282 A malicious Flatpak extension can probe the host filesystem to determine what fi... |
low | 3.1 | — | — | 2026-09-27 | 2026-09-29 |
| CVE-2026-96283 By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pul... |
low | 3.3 | — | — | 2026-09-27 | 2026-09-29 |
| CVE-2026-100881 A security vulnerability has been detected in zhistaredu StarTraining up to 3.8.... |
low | 2.6 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-101089 Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /... |
low | 3.1 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100880 A weakness has been identified in zhistaredu StarTraining up to 3.8.1. |
low | 3.5 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-101051 Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote... |
low | 3.1 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-101057 utcp-mcp (the MCP plugin of python-utcp) through 1.1.2 connects to the HTTP and... |
low | 3.1 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100867 spaceship-prompt through 4.22.5 fails to sanitize control characters from projec... |
low | 3.3 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100866 onefetch through 2.28.1 writes repository information field values to the termin... |
low | 3.3 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-93304 A (D)TLS 1.2 client can accept a ChangeCipherSpec message before it has sent its... |
low | 3.7 | — | Wolfssl / wolfssl | 2026-09-27 | 2026-10-02 |
| CVE-2026-86839 The Online Scheduling and Appointment Booking System WordPress plugin before 28.... |
low | 3.8 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100837 Contrast (Edgeless Systems) through 1.20.0 performs unanchored suffix matching w... |
low | 3.7 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2025-71424 Contrast, Edgeless Systems' runtime for confidential containers on Kubernetes, i... |
low | 3.5 | — | — | 2026-09-27 | 2026-10-14 |
| CVE-2026-100620 Capgo CLI (npm package @capgo/cli) through 7.98.2 is affected by an over-permiss... |
low | 3.8 | — | — | 2026-09-26 | 2026-10-05 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.