September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-94033 A vulnerability has been found in SourceCodester Drug Recommendation System 1.0. |
low | 3.5 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94034 A vulnerability was found in SourceCodester Drug Recommendation System 1.0. |
low | 3.5 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94030 A security vulnerability has been detected in SerenityOS up to 3d83e4509fd20d743... |
low | 3.1 | — | — | 2026-09-20 | 2026-09-24 |
| CVE-2026-94016 A security flaw has been discovered in SourceCodester Drug Recommendation System... |
low | 2.4 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-93977 A vulnerability was determined in code-projects Assessment Management 1.0. |
low | 3.5 | — | — | 2026-09-20 | 2026-09-24 |
| CVE-2026-93976 A vulnerability was found in code-projects Assessment Management 1.0. |
low | 2.4 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-93975 A vulnerability has been found in code-projects Assessment Management 1.0. |
low | 2.4 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-93968 A vulnerability was determined in aiyiyi121 SxDevOps 1.0/1.1. |
low | 3.8 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-92423 The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capabil... |
low | 2.7 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-92965 The TikTok WordPress plugin before 1.4.2 does not check that a request is author... |
low | 3.7 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-81651 The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not... |
low | 3.1 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-81652 The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not... |
low | 2.7 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-81654 The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not... |
low | 3.1 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-86551 The Z80Ultra (NX741J) product contains a vulnerability where non-privileged prog... |
low | 3.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-93956 A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. |
low | 3.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-93986 rclone before 1.75.1 fails to confine names from server and third-party listing... |
low | 3.1 | — | — | 2026-09-19 | 2026-09-22 |
| CVE-2026-93987 rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in... |
low | 3.4 | — | — | 2026-09-19 | 2026-09-22 |
| CVE-2026-93982 OpenPanel through 2.3.0 writes Model Context Protocol authentication tokens from... |
low | 3.3 | — | — | 2026-09-19 | 2026-10-02 |
| CVE-2026-92403 The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify... |
low | 3.7 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-92420 The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin b... |
low | 3.8 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2025-15698 The Business Name Generator WordPress plugin through 1.3 does not sanitise and e... |
low | 3.5 | — | — | 2026-09-19 | 2026-10-14 |
| CVE-2026-11545 IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to ob... |
low | 3.7 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93650 A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. |
low | 3.7 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-81178 SysReptor is a fully customizable pentest reporting platform. |
low | 3.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-81181 SysReptor is a fully customizable pentest reporting platform. |
low | 3.7 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-91142 A flaw was found in Cockpit. |
low | 3.6 | — | — | 2026-09-18 | 2026-10-16 |
| CVE-2026-85478 A CM2507 IP camera running firmware version HMT.CM2507 v251211.1507 exposes an i... |
low | 3.5 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-61633 NanoMQ is an MQTT broker. |
low | 2.0 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-44639 NanoMQ is an MQTT broker. |
low | 3.7 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-84400 CareCam CM2507 IP cameras contain an insufficiently protected network maintenanc... |
low | 3.1 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-84449 libheif is a HEIF and AVIF file format decoder and encoder. |
low | 3.7 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93676 xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configure... |
low | 3.2 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93505 A vulnerability was found in SveltyCMS 0.0.6. |
low | 3.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-16512 gptp_handle_msg() in subsys/net/l2/ethernet/gptp/gptp.c dereferenced the gPTP he... |
low | 3.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-93600 rustls-webpki (rustls/webpki) versions 0.101.0 through 0.103.11 and 0.104.0-alph... |
low | 2.2 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93601 rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prio... |
low | 2.2 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93586 ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulne... |
low | 3.3 | — | Imagemagick / imagemagick | 2026-09-18 | 2026-10-29 |
| CVE-2026-93587 ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the... |
low | 3.3 | — | Imagemagick / imagemagick | 2026-09-18 | 2026-10-29 |
| CVE-2026-28199 An authenticated user with access to the NetBackup Flex OS management
shell cou... |
low | 3.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-40538 An improper restriction of excessive authentication attempts vulnerability in Au... |
low | 3.7 | — | — | 2026-09-18 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.