September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-102142 A system notification template on the Kiteworks appliance was rendered by a temp... |
high | 7.2 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102143 An unauthenticated attacker could cause a file with attacker-controlled content... |
high | 7.5 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-13 |
| CVE-2026-102150 A function in the Kiteworks Advanced Forms component was reachable without authe... |
high | 7.2 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102127 An XML parser used by Kiteworks Email Protection Gateway did not restrict extern... |
high | 7.0 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-08 |
| CVE-2026-102128 An identity-verification weakness in Kiteworks Email Protection Gateway allowed... |
high | 7.5 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-08 |
| CVE-2026-102129 A user-provisioning interface in Kiteworks Core did not verify that the requesti... |
high | 7.2 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-08 |
| CVE-2026-102130 Kiteworks Email Protection Gateway did not sufficiently validate the content of... |
high | 7.2 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-08 |
| CVE-2026-102131 Kiteworks Email Protection Gateway rejected certain configuration settings, but... |
high | 7.2 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-08 |
| CVE-2026-102132 An administrative import function in Kiteworks Core did not verify that the requ... |
high | 7.2 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102120 A privilege escalation vulnerability in Kiteworks could have allowed an attacker... |
high | 8.8 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102121 A form-rendering interface in the Advanced Forms component is reachable without... |
high | 8.6 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-08 |
| CVE-2026-102123 A Kiteworks appliance setup interface did not confine a user-supplied file path... |
high | 7.4 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102125 The sandbox that isolates document conversion on a Kiteworks appliance did not f... |
high | 8.8 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-08 |
| CVE-2026-102126 A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an ad... |
high | 8.1 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102116 -A weakness could have allowed an authenticated Kiteworks Email Protection Gatew... |
high | 7.2 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-08 |
| CVE-2026-102117 On deployments where the remote-support capability is licensed and enabled, an a... |
high | 7.2 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-13 |
| CVE-2026-102118 A local privilege escalation vulnerability in Kiteworks could have allowed an at... |
high | 7.8 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102119 A path traversal weakness in an optional, non-default administrative feature all... |
high | 7.2 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-13 |
| CVE-2026-102112 A privilege escalation vulnerability in Kiteworks could allow an attacker who ha... |
high | 7.8 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102113 A privilege escalation vulnerability in Kiteworks could allow an attacker who ha... |
high | 7.8 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102114 A command injection vulnerability in Kiteworks could allow a high-privileged aut... |
high | 7.2 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102108 An authenticated administrator of Kiteworks Email Protection Gateway could submi... |
high | 7.2 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-08 |
| CVE-2026-102109 A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a va... |
high | 7.1 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-08 |
| CVE-2026-102096 Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that a... |
high | 7.2 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102097 Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Remote... |
high | 7.2 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-08 |
| CVE-2026-102098 Kiteworks Core before version 9.5.0 is vulnerable to SQL Injection. |
high | 7.2 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102099 Kiteworks Core before version 9.5.0 is vulnerable to Arbitrary File Write. |
high | 7.2 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102100 Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting... |
high | 8.7 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102101 Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untruste... |
high | 8.1 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102089 Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path... |
high | 7.2 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-08 |
| CVE-2026-102091 Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Re... |
high | 7.5 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-08 |
| CVE-2026-102092 Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting... |
high | 8.7 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102093 Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Manageme... |
high | 7.2 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102094 Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe... |
high | 7.2 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-08 |
| CVE-2023-54403 Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vulnerability... |
high | 7.5 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2024-58387 Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /ap... |
high | 7.5 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2023-54402 iDocView contains a server-side request forgery vulnerability in its /doc/upload... |
high | 7.5 | — | — | 2026-09-30 | 2026-10-05 |
| CVE-2026-102994 pypdf is a free and open-source pure-python PDF library. |
high | 7.5 | — | Pypdf Project / pypdf | 2026-09-30 | 2026-10-05 |
| CVE-2026-102993 pypdf is a free and open-source pure-python PDF library. |
high | 7.5 | — | Pypdf Project / pypdf | 2026-09-30 | 2026-10-02 |
| CVE-2026-101885 ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain a path tr... |
high | 7.8 | — | — | 2026-09-30 | 2026-10-01 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.