September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-102268 PyJWT is a Python implementation of JSON Web Token standards. |
critical | 9.1 | — | Pyjwt Project / pyjwt | 2026-09-28 | 2026-10-07 |
| CVE-2026-101187 A weakness has been identified in Ziroom ZHOME A0101 1.0.1.0. |
critical | 9.1 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-96760 Authlib (v1.7.2 and below) contains a signature verification bypass vulnerabilit... |
critical | 9.8 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101110 Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library... |
critical | 9.8 | — | Ordasoft / book library | 2026-09-28 | 2026-10-07 |
| CVE-2026-100752 Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate M... |
critical | 9.8 | — | Ordasoft / real estate manager | 2026-09-28 | 2026-10-27 |
| CVE-2026-101108 Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manag... |
critical | 9.8 | — | Ordasoft / vehicle manager | 2026-09-28 | 2026-10-27 |
| CVE-2026-49994 Bluehood monitors local bluetooth activity. |
critical | 9.1 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101894 The decompress package for Node.js extracts archives. |
critical | 9.1 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101081 A security flaw has been discovered in D-Link DI-8400 16.07. |
critical | 9.1 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-88804 An unauthenticated update of public UI settings could be used by remote attacker... |
critical | 9.6 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-12342 This vulnerability
impacts all versions of IdentityIQ and allows an unauthentica... |
critical | 9.6 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101077 A flaw has been found in Netcore NR289-GE 1.4.5102. |
critical | 10.0 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101076 A vulnerability was detected in Netcore NR289-GE 1.4.5102. |
critical | 10.0 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101075 A security vulnerability has been detected in Netcore NR289-GE 1.4.5102. |
critical | 10.0 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101074 A weakness has been identified in Netcore NR289-GE 1.4.5102. |
critical | 9.8 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-87799 Improper link resolution in the migration receive path in Canonical LXD versions... |
critical | 9.9 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-90924 Use of default credentials vulnerability in Innotim Software, Telecommunications... |
critical | 9.8 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-85185 Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and l... |
critical | 9.6 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-85526 Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Li... |
critical | 9.9 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-101072 A vulnerability was identified in Netcore NR289-GE 1.4.5102. |
critical | 10.0 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101038 A vulnerability was determined in FAST FAC1200R 5.0_20201119_1.0.2. |
critical | 9.9 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101039 A vulnerability was identified in FAST FAC1900R 20190827_2.0.2. |
critical | 10.0 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101037 A vulnerability was found in FAST FAC1200R 5.0_20201119_1.0.2. |
critical | 9.9 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-82384 Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticat... |
critical | 9.8 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-82377 Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to rea... |
critical | 9.9 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-82378 Incorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Rolle... |
critical | 9.0 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-101008 A vulnerability was found in aaPanel BaoTa up to 11.8.0. |
critical | 9.1 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101002 A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. |
critical | 9.9 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101000 A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. |
critical | 10.0 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101001 A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. |
critical | 10.0 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100896 A weakness has been identified in TOTOLINK N150RT 3.4.0-B20201030. |
critical | 9.9 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100886 A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 4.6.1.4... |
critical | 10.0 | — | — | 2026-09-27 | 2026-10-23 |
| CVE-2026-101090 Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect e... |
critical | 9.8 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-101065 Obot is an open-source AI agent/MCP platform. |
critical | 9.8 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-101084 obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-co... |
critical | 9.6 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-88771 Citrix NetScaler Improper Input Validation Vulnerability |
critical | 9.8 | Listed | Citrix / NetScaler | 2026-09-27 | 2026-09-29 |
| CVE-2026-88773 Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling')... |
critical | 10.0 | — | Citrix / netscaler application delivery controller | 2026-09-27 | 2026-09-29 |
| CVE-2026-88775 Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gatew... |
critical | 9.8 | — | Citrix / netscaler application delivery controller | 2026-09-27 | 2026-09-29 |
| CVE-2026-88776 Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix N... |
critical | 9.8 | — | Citrix / netscaler application delivery controller | 2026-09-27 | 2026-09-29 |
| CVE-2026-88777 Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix N... |
critical | 9.8 | — | Citrix / netscaler application delivery controller | 2026-09-27 | 2026-09-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.