September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-34151 XWiki Platform is a generic wiki platform. |
not reported | — | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-84445 gRPC-Go is the Go language implementation of gRPC. |
not reported | — | — | — | 2026-09-14 | 2026-09-25 |
| CVE-2026-55451 gettext-converter provides gettext resource conversion utilities for JavaScript. |
not reported | — | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54452 safeurl is a server-side request forgery protection library. |
not reported | — | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-55102 hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. |
not reported | — | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-88819 In Siglet current and past versions the refresh token handler do not enforce pro... |
not reported | — | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-87087 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-81301 Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider as... |
not reported | — | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-55795 Craft Commerce is an ecommerce platform for Craft CMS. |
not reported | — | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-7848 Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL... |
not reported | — | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-15600 Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL... |
not reported | — | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-90961 The LdapAuth and LinOTPAuth authentication plugins in MISP contain an authentica... |
not reported | — | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90955 Affected versions of MISP’s interactive CLI shell do not reliably preserve the i... |
not reported | — | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90957 Affected versions of MISP serve uploaded SVG images inline without a restrictive... |
not reported | — | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-12258 Inadequate access control in Hiperdino’s REST v1.0 API. |
not reported | — | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-79701 Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Con... |
not reported | — | — | — | 2026-09-14 | 2026-10-05 |
| CVE-2026-21391 An improper validation vulnerability exists within PingAM where a well-crafted r... |
not reported | — | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-78375 Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in th... |
not reported | — | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-79700 Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass via Request-C... |
not reported | — | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-81564 Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Renam... |
not reported | — | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-81565 Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Uploa... |
not reported | — | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-81566 Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation... |
not reported | — | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-20773 A role-based access control issue was identified in the administrative expressio... |
not reported | — | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-90895 Affected versions of MISP’s interactive CLI shell implement access control indep... |
not reported | — | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90893 MISP contains a Cross-Site Request Forgery (CSRF) vulnerability in the UserSetti... |
not reported | — | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-12518 A local privilege escalation vulnerability in the Logitech Logi Options+ updater... |
not reported | — | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-88852 Joomla Extension - regularlabs.com - Privileged stored XSS via url option in Sni... |
not reported | — | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-88853 Joomla Extension - regularlabs.com - Privileged stored XSS via event handler opt... |
not reported | — | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-85196 Joomla Extension - regularlabs.com - Reflected XSS in Articles Anywhere extensio... |
not reported | — | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-85188 Joomla Extension - regularlabs.com - Database data disclosure in Advanced Module... |
not reported | — | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-85189 Joomla Extension - regularlabs.com - Privileged stored XSS via executable URL sc... |
not reported | — | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-85190 Joomla Extension - regularlabs.com - Privileged stored XSS via class option in Q... |
not reported | — | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-85191 Joomla Extension - regularlabs.com - Privileged stored XSS via rtla-alias option... |
not reported | — | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-85192 Joomla Extension - regularlabs.com - Authenticated, privileged remote code execu... |
not reported | — | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-85195 Joomla Extension - regularlabs.com - Privileged stored XSS via link option in Ar... |
not reported | — | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-71198 In OpenStack Glance before 32.0.1, the location API does not validate destinatio... |
not reported | — | — | — | 2026-09-14 | 2026-09-22 |
| CVE-2026-16726 Buffer overflow vulnerability in Panasonic Industry USB Driver for MINAS A5/A6 a... |
not reported | — | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-49030 Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-09-13 | 2026-09-13 |
| CVE-2026-90648 wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situatio... |
not reported | — | — | — | 2026-09-13 | 2026-10-23 |
| CVE-2026-89172 Improper protection of physical side channels vulnerability in Microchip AN1044,... |
not reported | — | — | — | 2026-09-12 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.