September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-102248 A vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5. |
high | 7.3 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102249 A security flaw has been discovered in REBUILD up to 4.4.11. |
high | 7.3 | — | — | 2026-09-29 | 2026-10-01 |
| CVE-2026-102245 A weakness has been identified in MODSetter SurfSense up to 2.0.3. |
high | 7.3 | — | — | 2026-09-29 | 2026-10-01 |
| CVE-2026-102243 A vulnerability was identified in MODSetter SurfSense up to 2.0.3. |
high | 7.4 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-96326 The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPres... |
high | 7.2 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-101860 A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. |
high | 8.8 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-101878 Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-101280 A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. |
high | 7.3 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-101281 A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. |
high | 7.3 | — | — | 2026-09-29 | 2026-10-01 |
| CVE-2026-102335 Nginx Proxy Manager through 2.16.0 fails to restrict the advanced_config field t... |
high | 7.1 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-102334 Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoin... |
high | 7.4 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-102281 Nest is a framework for building scalable Node.js server-side applications. |
high | 7.5 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101188 A security vulnerability has been detected in Netcore POWER13 2.0.240730.162638. |
high | 8.3 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101091 SiYuan versions before v3.8.4 fail to properly validate SQL statements in block... |
high | 7.1 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2024-42002 A code injection vulnerability has been discovered in the Robot Operating System... |
high | 8.4 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-84895 In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSessio... |
high | 7.3 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-91096 In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminat... |
high | 7.5 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-18413 The ADC API requires each driver to reject a sampling sequence whose destination... |
high | 7.8 | — | Zephyrproject / zephyr | 2026-09-28 | 2026-10-27 |
| CVE-2026-18414 The ADC API requires each driver to reject a sampling sequence whose destination... |
high | 7.8 | — | Zephyrproject / zephyr | 2026-09-28 | 2026-10-27 |
| CVE-2026-18415 ieee802154_send() in subsys/net/l2/ieee802154/ieee802154.c copies the outgoing p... |
high | 7.1 | — | Zephyrproject / zephyr | 2026-09-28 | 2026-10-27 |
| CVE-2026-102276 The brace-expansion library generates arbitrary strings containing a common pref... |
high | 7.5 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-102278 The brace-expansion library generates arbitrary strings containing a common pref... |
high | 7.5 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-16513 The userspace verifier z_vrfy_rtio_sqe_copy_in_get_handles() in subsys/rtio/rtio... |
high | 7.8 | — | Zephyrproject / zephyr | 2026-09-28 | 2026-10-27 |
| CVE-2026-102271 PyJWT is a Python implementation of JSON Web Token standards. |
high | 7.4 | — | Pyjwt Project / pyjwt | 2026-09-28 | 2026-10-06 |
| CVE-2026-102272 PyJWT is a Python implementation of JSON Web Token standards. |
high | 7.4 | — | Pyjwt Project / pyjwt | 2026-09-28 | 2026-10-06 |
| CVE-2026-102273 PyJWT is a Python implementation of JSON Web Token standards. |
high | 7.4 | — | Pyjwt Project / pyjwt | 2026-09-28 | 2026-10-06 |
| CVE-2026-102274 PyJWT is a Python implementation of JSON Web Token standards. |
high | 7.5 | — | Pyjwt Project / pyjwt | 2026-09-28 | 2026-10-06 |
| CVE-2026-102275 PyJWT is a Python implementation of JSON Web Token standards. |
high | 8.2 | — | Pyjwt Project / pyjwt | 2026-09-28 | 2026-10-06 |
| CVE-2026-101916 @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, wi... |
high | 7.4 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101917 PyJWT is a Python implementation of JSON Web Token standards. |
high | 7.5 | — | Pyjwt Project / pyjwt | 2026-09-28 | 2026-10-07 |
| CVE-2026-101918 PyJWT is a Python implementation of JSON Web Token standards. |
high | 7.5 | — | Pyjwt Project / pyjwt | 2026-09-28 | 2026-10-07 |
| CVE-2026-86950 Apple Multiple Products Out-of-Bounds Write Vulnerability |
high | 8.8 | Listed | Apple / Multiple Products | 2026-09-28 | 2026-10-27 |
| CVE-2026-87741 The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrust... |
high | 8.8 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-93355 LiteLLM contains a weak authentication vulnerability that allows an attacker hol... |
high | 8.1 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-102004 Wind River VxWorks 7 prior to 26.09, specific system call arguments can result i... |
high | 7.8 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-84894 In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps usin... |
high | 7.5 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-97023 A path traversal vulnerability in Flatpak's handling of the export/bin directory... |
high | 7.1 | — | — | 2026-09-28 | 2026-10-26 |
| CVE-2026-102010 A flaw was found in GCC. |
high | 7.0 | — | — | 2026-09-28 | 2026-10-29 |
| CVE-2026-75600 FreePBX is an open source IP PBX. |
high | 8.8 | — | Sangoma / freepbx | 2026-09-28 | 2026-10-16 |
| CVE-2026-54710 FreePBX is an open source IP PBX. |
high | 8.8 | — | Sangoma / freepbx | 2026-09-28 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.