September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100872 Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during... |
high | 7.5 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100748 Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery... |
high | 8.8 | — | Svenbluege / event gallery | 2026-09-27 | 2026-10-20 |
| CVE-2026-97164 Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in `cle... |
high | 8.1 | — | Svenbluege / event gallery | 2026-09-27 | 2026-10-27 |
| CVE-2026-93302 MatchTrustedPeer ignores the public key used, leading to forged CA clones passin... |
high | 8.2 | — | Wolfssl / wolfssl | 2026-09-27 | 2026-10-02 |
| CVE-2026-94418 Under WOLFSSL_SMALL_CERT_VERIFY, ProcessPeerCertParse() runs the certificate sig... |
high | 7.5 | — | Wolfssl / wolfssl | 2026-09-27 | 2026-10-02 |
| CVE-2026-96896 The Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin before 19... |
high | 7.2 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-86609 The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape... |
high | 8.8 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-81655 The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict acces... |
high | 7.5 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100746 A vulnerability was found in coollabsio Coolify up to 4.1.0. |
high | 7.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100864 heym before 0.0.91 contains a sandbox escape vulnerability in the expression eng... |
high | 8.8 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100865 Heym before 0.0.53 evaluates workflow condition expressions using Python's eval(... |
high | 8.8 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100856 AzuraCast before 0.23.6 contains a code injection vulnerability in the remote re... |
high | 8.8 | — | — | 2026-09-27 | 2026-10-08 |
| CVE-2026-100857 AzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWri... |
high | 8.0 | — | — | 2026-09-27 | 2026-10-08 |
| CVE-2026-100850 AzuraCast before 0.23.8 contains a server-side request forgery and local file re... |
high | 7.7 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100851 AzuraCast before 0.23.8 contains a broken access control vulnerability in the GE... |
high | 7.6 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100852 AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquid... |
high | 8.8 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100845 MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the Numpy... |
high | 7.8 | — | Project-monai / monai | 2026-09-27 | 2026-09-30 |
| CVE-2026-100846 MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in... |
high | 8.8 | — | Project-monai / monai | 2026-09-27 | 2026-10-08 |
| CVE-2026-100847 AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder... |
high | 7.5 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100848 AzuraCast (Composer package azuracast/azuracast) before 0.23.8 validates a stati... |
high | 7.1 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100849 AzuraCast is a self-hosted web radio management suite. |
high | 7.1 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100838 Contrast is a confidential-computing runtime for Kubernetes. |
high | 8.1 | — | — | 2026-09-27 | 2026-10-08 |
| CVE-2026-100839 Contrast is a confidential-computing runtime for Kubernetes. |
high | 8.4 | — | — | 2026-09-27 | 2026-10-08 |
| CVE-2026-100840 MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle... |
high | 7.8 | — | Project-monai / monai | 2026-09-27 | 2026-09-30 |
| CVE-2026-100841 In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the... |
high | 7.8 | — | Project-monai / monai | 2026-09-27 | 2026-09-30 |
| CVE-2026-100842 MONAI through 1.6.0 contains an eval injection vulnerability in _get_fake_spatia... |
high | 8.8 | — | Project-monai / monai | 2026-09-27 | 2026-09-30 |
| CVE-2026-100843 MONAI versions before 1.6.0 contain a remote code execution vulnerability in the... |
high | 7.8 | — | Project-monai / monai | 2026-09-27 | 2026-09-30 |
| CVE-2026-100844 MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner c... |
high | 7.8 | — | Project-monai / monai | 2026-09-27 | 2026-09-30 |
| CVE-2026-100835 Contrast before 1.16.0 is susceptible to remote attestation relay attacks. |
high | 7.4 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100744 A flaw has been found in coollabsio Coolify up to 4.1.2. |
high | 7.3 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100723 vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (b... |
high | 7.5 | — | — | 2026-09-27 | 2026-10-01 |
| CVE-2025-71426 Contrast is a confidential-computing runtime for Kubernetes. |
high | 7.1 | — | — | 2026-09-27 | 2026-10-14 |
| CVE-2025-71425 Contrast (Edgeless Systems) before 1.8.1 logs the workload secret to stderr, and... |
high | 7.3 | — | — | 2026-09-27 | 2026-10-14 |
| CVE-2025-71423 Edgelesssys Contrast is a confidential-computing runtime for Kubernetes. |
high | 7.3 | — | — | 2026-09-27 | 2026-10-14 |
| CVE-2026-100739 A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5d... |
high | 7.3 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-72668 Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent B... |
high | 7.3 | — | — | 2026-09-26 | 2026-09-29 |
| CVE-2026-77203 The Groups – Memberships and Access Control plugin for WordPress is vulnerable t... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-94132 Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailb... |
high | 8.1 | — | Acymailing / acymailing | 2026-09-26 | 2026-10-20 |
| CVE-2026-97160 Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection i... |
high | 8.8 | — | Lomart / up | 2026-09-26 | 2026-10-20 |
| CVE-2026-97161 Joomla Extension - lomart.fr - Various path traversal / file access vectors in U... |
high | 7.5 | — | Lomart / up | 2026-09-26 | 2026-10-20 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.