September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86060 MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vu... |
critical | 9.8 | Listed | MikroTik / RouterOS | 2026-09-05 | 2026-09-11 |
| CVE-2026-67278 MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based... |
critical | 9.1 | — | Mikrotik / routeros | 2026-09-05 | 2026-09-25 |
| CVE-2026-86189 WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php th... |
critical | 9.8 | — | — | 2026-09-05 | 2026-09-18 |
| CVE-2026-86190 WWBN AVideo contains a broken access control vulnerability in videoViewsInfo end... |
critical | 9.1 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86184 Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in t... |
critical | 9.8 | — | — | 2026-09-05 | 2026-09-18 |
| CVE-2026-10196 The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emai... |
critical | 9.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86121 Cua computer-server versions before 0.3.42 skip authentication when the CONTAINE... |
critical | 9.8 | — | — | 2026-09-05 | 2026-09-24 |
| CVE-2026-86124 AutoAgent contains an unauthenticated remote code execution vulnerability in the... |
critical | 9.8 | — | — | 2026-09-05 | 2026-09-24 |
| CVE-2024-11080 The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnera... |
critical | 9.8 | — | — | 2026-09-05 | 2026-10-27 |
| CVE-2026-78362 The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly vali... |
critical | 9.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-83627 The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for... |
critical | 9.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-13447 The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via J... |
critical | 9.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-52766 YesWiki is a wiki system written in PHP. |
critical | 9.1 | — | — | 2026-09-05 | 2026-09-09 |
| CVE-2026-75925 Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.... |
critical | 9.6 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-50894 easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous T... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2025-67066 SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker... |
critical | 9.8 | — | — | 2026-09-04 | 2026-10-26 |
| CVE-2026-79391 No authentication exists in the MQTT service of Trueview 6.0.23.4. |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-71624 An issue in esoTalk v.1.0.0g4 allows a remote attacker to execute arbitrary code... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-71625 An issue in slimkit plus ThinkSNS+ v.2.4 allows a remote attacker to escalate pr... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-81939 A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem... |
critical | 9.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-78327 An Improper Neutralization of Special Elements used in an OS Command ('OS Comman... |
critical | 9.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-78328 A missing authorization vulnerability in the SonicWall Network Security Manager... |
critical | 9.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-57162 PJSIP is a free and open source multimedia communication library written in C. |
critical | 9.1 | — | Teluu / pjsip | 2026-09-04 | 2026-09-11 |
| CVE-2026-57163 PJSIP is a free and open source multimedia communication library written in C. |
critical | 9.1 | — | Teluu / pjsip | 2026-09-04 | 2026-09-11 |
| CVE-2026-84961 undici's BalancedPool constructor passes its entire options object through an in... |
critical | 9.1 | — | Nodejs / undici | 2026-09-04 | 2026-09-15 |
| CVE-2026-78745 An issue in HiDPT/ Weyon HiDPTAndroid Hi3751V350 Hi3751V352E_DMO allows a remote... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-75430 PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-18221 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized... |
critical | 9.8 | — | Ibm / i | 2026-09-04 | 2026-09-08 |
| CVE-2026-31020 In DocsGPT 0.15.0 and below, the application provides a custom prompt feature th... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-17207 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of... |
critical | 9.1 | — | Ibm / i | 2026-09-04 | 2026-09-08 |
| CVE-2026-17057 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of... |
critical | 9.1 | — | Ibm / i | 2026-09-04 | 2026-09-08 |
| CVE-2026-75171 An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-14 |
| CVE-2026-75429 PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execu... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-14 |
| CVE-2026-75431 PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signin... |
critical | 9.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-77822 IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obta... |
critical | 9.6 | — | Ibm / contextforge | 2026-09-04 | 2026-09-15 |
| CVE-2026-75160 An issue in X-Serie Gateway Firmware V6_00_05 allows a remote attacker to escala... |
critical | 9.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-44402 Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code executi... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-18658 IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1,... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-19274 IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana... |
critical | 9.6 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85696 SadTalker contains an OS command injection vulnerability in the video muxing pro... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.