September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-90623 A weakness has been identified in andreashappe cochise up to 0.4.1. |
low | 3.7 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2023-24034 An issue was discovered in twilio_ajax_handler.php in Nagios XI before 5.9.3. |
low | 3.1 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-24035 An issue was discovered in Nagios XI before 5.9.3. |
low | 3.5 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-24283 Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a b... |
low | 2.9 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-90622 A security flaw has been discovered in GNU libredwg 0.13.4. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2023-22632 PRTG Network Monitor before 23.1.82 allows remote attackers to write to files vi... |
low | 2.7 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2023-22631 PRTG Network Monitor before 23.1.82 allows remote attackers to write to files vi... |
low | 2.7 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-33966 An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380,... |
low | 2.8 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-33967 An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380,... |
low | 2.8 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-33968 An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380,... |
low | 2.8 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-33970 An issue was discovered in NR RRC and L2 in Samsung Mobile Processor, Wearable P... |
low | 3.5 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-38924 In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP m... |
low | 2.9 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-90610 A vulnerability was found in GPAC up to f1219cde. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90611 A vulnerability was determined in GPAC up to f1219cde. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90612 A vulnerability was identified in GPAC up to f1219cde. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90613 A security flaw has been discovered in GPAC up to f1219cde. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-33956 An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380,... |
low | 2.8 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-33960 An issue was discovered in Samsung Mobile Processor and Wearable Processor Exyno... |
low | 2.8 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-33962 An issue was discovered in Wi-Fi in Samsung Mobile Processor Exynos 850, 1280, 1... |
low | 2.8 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-23793 An issue was discovered in Samsung Mobile Processor Exynos 1330, 1380, 1480, and... |
low | 3.5 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-90609 A vulnerability has been found in GPAC up to f1219cde. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-23786 An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 13... |
low | 2.8 | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2025-64031 libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzi... |
low | 2.5 | — | — | 2026-09-14 | 2026-10-14 |
| CVE-2026-90604 A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. |
low | 3.5 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90602 A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.... |
low | 3.5 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-35867 A Command Injection vulnerability exists in the bs_SetLimitCli_info function wit... |
low | 3.1 | — | — | 2026-09-13 | 2026-09-22 |
| CVE-2026-38332 TinyEXIF before 1.1.0 has a heap-based buffer over-read in EntryParser::Fetch me... |
low | 2.9 | — | — | 2026-09-13 | 2026-09-22 |
| CVE-2025-70820 Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders ot... |
low | 3.5 | — | — | 2026-09-13 | 2026-10-14 |
| CVE-2025-45480 Floodlight 71fe8a7 allows disruption of host communication via link spoofing. |
low | 3.0 | — | — | 2026-09-13 | 2026-10-14 |
| CVE-2025-64059 Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. |
low | 1.8 | — | — | 2026-09-13 | 2026-10-14 |
| CVE-2026-90576 A security vulnerability has been detected in GPAC up to f1219cde. |
low | 3.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90575 A weakness has been identified in PHPGurukul Small CRM 4.0. |
low | 3.7 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90573 A vulnerability was identified in GPAC up to f1219cde. |
low | 3.3 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90569 A flaw has been found in linlinjava litemall 1.5.0/1.6.0/1.7.0/1.8.0. |
low | 2.4 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90570 A vulnerability has been found in linlinjava litemall 1.4.0/1.5.0/1.6.0/1.7.0/1.... |
low | 2.4 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90568 A vulnerability was detected in moxi624 Mogu Blog v2 up to 5.2. |
low | 3.5 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90567 A security vulnerability has been detected in quequnlong shiyi-blog up to 1.2.1. |
low | 3.5 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90564 A vulnerability was identified in quequnlong shiyi-blog 1.0.0-1.2.1. |
low | 3.5 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90528 A flaw has been found in TDuckApp tduck-platform up to 5.3. |
low | 3.5 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90529 A vulnerability has been found in DataEase up to 2.10.25/2.10.26. |
low | 3.5 | — | — | 2026-09-13 | 2026-09-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.