September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86530 BUFFALO Wi-Fi products handle some web form input improperly to assemble command... |
high | 7.2 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101015 A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. |
high | 7.3 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101014 A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. |
high | 7.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82383 Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an un... |
high | 8.2 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82386 Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 all... |
high | 7.7 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-82375 Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticate... |
high | 7.4 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82376 Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 all... |
high | 7.7 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-82379 Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacke... |
high | 7.7 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-82380 Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacke... |
high | 8.1 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82348 Authorization Bypass Through User-Controlled Key in Apache Roller 6.1.5 allows a... |
high | 7.7 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-101012 A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to... |
high | 7.3 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101013 A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Pr... |
high | 7.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101007 A vulnerability has been found in aaPanel BaoTa up to 11.8.0. |
high | 8.4 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101009 A vulnerability was determined in aaPanel BaoTa up to 11.8.0. |
high | 8.4 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101005 A vulnerability was detected in October CMS up to 4.3.4. |
high | 7.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100750 Joomla Extension - regularlabs.com - LFI / SSRF in Modules Anywhere 1.5.0 - 9.0.... |
high | 7.5 | — | Regularlabs / modules anywhere | 2026-09-28 | 2026-10-27 |
| CVE-2026-100909 A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. |
high | 7.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100908 A vulnerability has been found in Eyeplus 57.0.0.0308. |
high | 7.5 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100901 A vulnerability was found in athlon1600 youtube-downloader up to 4.0.1. |
high | 7.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100893 A vulnerability was determined in Privoce VoceChat Server up to 0.5.36. |
high | 7.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100891 A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2. |
high | 7.3 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-100888 A weakness has been identified in Trusted Domain Project OpenDKIM up to 2.11.0. |
high | 7.3 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-100889 A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. |
high | 7.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100885 A vulnerability was found in Krayin laravel-crm up to 2.2.4. |
high | 7.3 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-96280 The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O an... |
high | 7.5 | — | — | 2026-09-27 | 2026-10-27 |
| CVE-2026-101062 Obot before v0.23.0 (affected versions <= v0.22.1) running with OBOT_SERVER_ENAB... |
high | 8.8 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-101064 Obot before v0.23.0 contains a server-side request forgery vulnerability in remo... |
high | 7.6 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100875 A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to... |
high | 7.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100874 A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098... |
high | 7.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-101059 utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote O... |
high | 7.1 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-101060 python-utcp versions before 1.1.4 contain a server-side request forgery vulnerab... |
high | 8.2 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-101044 pacquet, the Rust package-manager component shipped in the pnpm npm package vers... |
high | 7.1 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-101045 Fleet-maintained app install and uninstall scripts for macOS are generated from... |
high | 8.0 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-101043 pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} envi... |
high | 7.4 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-88778 Predictable exact value from previous values vulnerability in Citrix NetScaler A... |
high | 7.5 | — | Citrix / netscaler application delivery controller | 2026-09-27 | 2026-09-29 |
| CVE-2026-88772 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memor... |
high | 8.1 | Listed | Citrix / NetScaler | 2026-09-27 | 2026-09-28 |
| CVE-2026-88774 Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. |
high | 7.2 | — | Citrix / netscaler application delivery controller | 2026-09-27 | 2026-09-29 |
| CVE-2026-101032 navi through 2.24.0 fails to properly escape cheatsheet variable values when sub... |
high | 7.0 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100870 Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build admini... |
high | 8.8 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100871 Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to incl... |
high | 8.8 | — | — | 2026-09-27 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.