September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-19547 Ghostscript for Windows is vulnerable to local privilege escalation through Post... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-96430 Exposed Dangerous Method or Function in the
/WebAgenda/SQLWin.do API endpoint of... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-96431 Unrestricted Upload of File with Dangerous Type in the
/WebAgenda/download/uploa... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-96440 Improper Limitation of a Pathname to a Restricted
Directory（Path Traversal） in... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-96428 SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-96429 SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API
endpoint of Flowring... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-101169 In affected versions of Octopus Server, an authenticated user with permissions t... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-97685 An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surve... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-100371 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-100392 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101912 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101913 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101910 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101911 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in... |
not reported | — | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101906 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101907 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101908 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101909 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101900 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101901 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101902 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101903 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101904 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101905 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101898 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-86102 An OS command injection vulnerability in the WatchGuard AP internal API service... |
not reported | — | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-87969 An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows... |
not reported | — | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-58463 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-28 | 2026-10-16 |
| CVE-2026-58464 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-28 | 2026-10-16 |
| CVE-2026-48100 Payy is an Ethereum L2 zk-rollup for privacy preserving and regulatory compliant... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101891 An improper access control vulnerability in an internal API service on WatchGuar... |
not reported | — | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-91154 Missing Authentication for Critical Function (CWE-306) in the product cache reva... |
not reported | — | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-96538 WarehousePG (WHPG) 7.x before 7.6.0-WHPG is affected by a missing authorization... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-73641 Dayforce ESS Excelity is vulnerable to Reflected XSS in multiple endpoints. |
not reported | — | — | — | 2026-09-28 | 2026-10-13 |
| CVE-2026-73642 Dayforce ESS Excelity is vulnerable to Path Traversal in file download functiona... |
not reported | — | — | — | 2026-09-28 | 2026-10-13 |
| CVE-2026-73640 Dayforce ESS Excelity is vulnerable to Time Based-Blind SQL Injection in passwor... |
not reported | — | — | — | 2026-09-28 | 2026-10-13 |
| CVE-2026-82936 mH-DEVELOPER smart home module is vulnerable to Denial of Service due to uncontr... |
not reported | — | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82928 mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh... |
not reported | — | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82929 mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every d... |
not reported | — | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82930 mH-DEVELOPER smart home module does not verify tokens in its authorization middl... |
not reported | — | — | — | 2026-09-28 | 2026-09-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.