September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100311 A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to... |
low | 3.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-96525 The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an o... |
low | 2.7 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-96526 The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an o... |
low | 2.7 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100573 OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability... |
low | 3.3 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100542 OpenClaw (npm package 'openclaw') versions >= 2026.5.28 and < 2026.8.1 mishandle... |
low | 3.1 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100537 OpenClaw (npm package 'openclaw') before 2026.8.1 fails to apply the originating... |
low | 3.1 | — | — | 2026-09-26 | 2026-09-29 |
| CVE-2026-100539 OpenClaw (npm package 'openclaw') before 2026.8.1 fails to revoke memory tool ac... |
low | 2.6 | — | — | 2026-09-26 | 2026-10-05 |
| CVE-2026-100534 OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability... |
low | 3.1 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-6103 phar_tar_number() parses the octal size field of a TAR header into a uint32_t wi... |
low | 3.3 | — | Php / php | 2026-09-25 | 2026-10-23 |
| CVE-2026-100417 RustDesk before 1.5.0 on Windows fails to enforce the one-way file transfer opti... |
low | 3.1 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-97897 A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. |
low | 3.5 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-97896 A vulnerability was identified in krayin laravel-crm up to 2.2.5. |
low | 3.5 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-97868 A security vulnerability has been detected in sheshbabu zen up to 1.5.0. |
low | 3.5 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-97228 Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query... |
low | 2.7 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-75553 Smartphone application Tohoku Electric Power "Yorisou e Net" uses a hard-coded c... |
low | 2.4 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-97721 A weakness has been identified in Sanluan PublicCMS up to 6.202506.e. |
low | 2.7 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-97764 django-allauth before 65.19.4 does not have the expected limits on failed login... |
low | 3.7 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-93353 copyparty contains a volume restriction bypass vulnerability in its SFTP front e... |
low | 3.1 | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-97233 A vulnerability was identified in volotat Anagnorisis up to 0.4.11. |
low | 3.5 | — | — | 2026-09-24 | 2026-10-05 |
| CVE-2026-63630 BentoPDF is a client-side PDF toolkit that is self hostable. |
low | 3.4 | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-73064 In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can caus... |
low | 2.9 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-19492 IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31,... |
low | 3.2 | — | Ibm / power system s1122 \(9824-22a\) firmware | 2026-09-24 | 2026-09-30 |
| CVE-2026-77797 Velociraptor's prefetch library contains an out of bound vulnerability which may... |
low | 3.6 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-17511 IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31,... |
low | 3.4 | — | Ibm / power system s1122 \(9824-22a\) firmware | 2026-09-24 | 2026-09-30 |
| CVE-2026-18104 IBM Db2 Mirror for i 7.6, 7.5, and 7.4 could allow a local attacker to obtain se... |
low | 3.3 | — | Ibm / db2 mirror for i | 2026-09-24 | 2026-09-29 |
| CVE-2026-18857 IBM OPENBMC FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060... |
low | 3.4 | — | Ibm / power system s1122 \(9824-22a\) firmware | 2026-09-24 | 2026-09-30 |
| CVE-2026-89004 The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not verify ow... |
low | 2.7 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-93661 The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update r... |
low | 2.7 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-84151 The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the W... |
low | 3.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96810 A vulnerability was identified in huanzi-qch base-admin up to 52816b760cd5324498... |
low | 3.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-92628 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6... |
low | 3.1 | — | Gitlab / gitlab | 2026-09-24 | 2026-09-28 |
| CVE-2026-96550 A vulnerability was found in sfturing hosp_order up to 627f426331da8086ce8fff201... |
low | 3.7 | — | — | 2026-09-23 | 2026-09-29 |
| CVE-2026-96552 A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8f... |
low | 3.1 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96546 A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS ima... |
low | 2.5 | — | — | 2026-09-23 | 2026-09-25 |
| CVE-2026-96549 A vulnerability has been found in sfturing hosp_order up to 627f426331da8086ce8f... |
low | 3.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-71463 Notification template Jinja AST whitelist only inspects
static Getattr nodes. |
low | 2.7 | — | — | 2026-09-23 | 2026-09-25 |
| CVE-2026-71464 LaunchConfigurationBaseSerializer.scm_branch has no
validate_scm_branch() leadi... |
low | 3.1 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-71465 RunAdHocCommand.build_args() appends limit as bare
positional (args.append(limi... |
low | 3.1 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96675 alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the mult... |
low | 3.3 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-4921 IBM Guardium Data Protection 12.2 could allow an administrative user to obtain s... |
low | 2.7 | — | Ibm / guardium data protection | 2026-09-23 | 2026-10-20 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.