September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-21587 This High severity Improper Authorization vulnerability was introduced in versio... |
not reported | — | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-89307 The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allo... |
not reported | — | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-87791 A path traversal vulnerability exists in the reserved_file_check function of the... |
not reported | — | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-87792 The "Design Scuole Italia" WordPress theme is affected by multiple Authorization... |
not reported | — | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-87793 The "Design Scuole Italia" WordPress theme is affected by a Reflected XSS vulner... |
not reported | — | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-77866 Server-Side Request Forgery (SSRF) vulnerability in Slab safeurl allows an attac... |
not reported | — | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-77972 Time-of-check Time-of-use (TOCTOU) Race Condition in Slab safeurl allows an atta... |
not reported | — | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-55775 OpenBao is an open source identity-based secrets management system. |
not reported | — | — | — | 2026-09-15 | 2026-09-25 |
| CVE-2026-55828 qbee transport is a remote access transport protocol implementation. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55864 GeoNetwork is a catalog application to manage spatially referenced resources. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55887 MCP Gateway allows easy and secure running and deployment of MCP servers. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55701 The OpenTelemetry Collector Contrib repository contains components for the OpenT... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55774 OpenBao is an open source identity-based secrets management system. |
not reported | — | — | — | 2026-09-15 | 2026-09-25 |
| CVE-2026-54450 ToolHive is a utility designed to simplify the deployment and management of Mode... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55630 Kiwi TCMS is an open source test management system. |
none | 0.0 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-19407 Bucket Squatting in Google Cloud Gemini Enterprise Agent Platform SDK for Python... |
not reported | — | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-92082 By default, Payara Server does not limit the number of failed login attempts, wh... |
not reported | — | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-61549 Woodpecker is a CI/CD engine. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54254 Cyberdrop-DL is a bulk asynchronous downloader for multiple file hosts. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54637 Dragonfly is an open source P2P-based file distribution and image acceleration s... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55617 Hydro is a next-generation high-performance online judge platform. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-52724 Kuma is a modern Envoy-based service mesh that can run on every cloud across bot... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-53966 XWiki Platform is a generic wiki platform. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-49254 Dragonfly is an open source P2P-based file distribution and image acceleration s... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-50166 Kuma is a modern Envoy-based service mesh that can run on every cloud across bot... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-46495 OpenDJ is an LDAPv3 compliant directory service. |
not reported | — | — | — | 2026-09-15 | 2026-09-25 |
| CVE-2026-47780 free5GC is an open-source implementation of the 5G core network. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-77179 On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-92002 Affected versions of MISP use Redis to throttle repeated authentication-failure... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-92003 Affected versions of MISP do not consistently apply the existing authentication-... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-89308 An unauthenticated OS command injection vulnerability exists in the ping.php end... |
not reported | — | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-52828 Kimai is an open-source time tracking application. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-52821 Kimai is an open-source time tracking application. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-52822 Kimai is an open-source time tracking application. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-52823 Kimai is an open-source time tracking application. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-52824 Kimai is an open-source time tracking application. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-52825 Kimai is an open-source time tracking application. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-52826 Kimai is an open-source time tracking application. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-52827 Kimai is an open-source time tracking application. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-52819 Kimai is an open-source time tracking application. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.