September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-94131 Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in A... |
high | 8.1 | — | Acymailing / acymailing | 2026-09-26 | 2026-10-20 |
| CVE-2026-100720 Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. |
high | 8.7 | — | — | 2026-09-26 | 2026-09-26 |
| CVE-2026-100713 Froxlor 2.3.10 and earlier contain a time-of-check time-of-use (TOCTOU) race con... |
high | 7.8 | — | — | 2026-09-26 | 2026-09-26 |
| CVE-2026-100718 Froxlor through 2.3.10 does not enforce the mail.allow_external_domains policy i... |
high | 7.1 | — | — | 2026-09-26 | 2026-09-26 |
| CVE-2026-100708 Froxlor before 2.3.13 returns the ssl_key_file column — which stores the raw PEM... |
high | 7.1 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100709 Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (p... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-26 |
| CVE-2026-100711 froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API k... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100700 nodemailer before 10.0.6 contains a denial of service vulnerability in the addre... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100703 Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its... |
high | 7.7 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100704 Kyverno is a policy engine for Kubernetes. |
high | 7.7 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100705 Kyverno before 1.19.1 is vulnerable to server-side request forgery. |
high | 7.6 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100707 Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall conte... |
high | 7.7 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100693 Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation... |
high | 8.4 | — | Gohugo / hugo | 2026-09-26 | 2026-09-30 |
| CVE-2026-100697 Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins... |
high | 8.6 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100686 Budibase versions before 3.45.0 fail to validate per-app authorization in the PO... |
high | 8.1 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100690 Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css... |
high | 7.5 | — | Gohugo / hugo | 2026-09-26 | 2026-09-30 |
| CVE-2026-100692 Hugo is a static site generator. |
high | 7.5 | — | Gohugo / hugo | 2026-09-26 | 2026-09-29 |
| CVE-2026-100680 Budibase versions before 3.45.0 fail to disable external JSON reference resoluti... |
high | 8.1 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100682 Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in... |
high | 8.8 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100683 Budibase (@budibase/server) before 3.45.0 builds MySQL and MSSQL column-rename D... |
high | 8.0 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100684 Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the O... |
high | 8.1 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100685 Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint... |
high | 7.7 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100673 The Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 th... |
high | 8.2 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100676 January, the media proxy/embed service of stoatchat (stoatchat/stoatchat), befor... |
high | 8.2 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100679 stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authent... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100669 Grav before 2.0.25 ships web server configuration samples whose access-control d... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100670 Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100671 Grav is a flat-file CMS. |
high | 8.0 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100672 The Comments plugin (getgrav/grav-plugin-comments) for Grav CMS through version... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100661 Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4... |
high | 7.5 | — | — | 2026-09-26 | 2026-10-02 |
| CVE-2026-100662 Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100663 Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.1... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100664 Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100665 Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostn... |
high | 7.5 | — | — | 2026-09-26 | 2026-10-02 |
| CVE-2026-100666 Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final thro... |
high | 7.3 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100660 Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.0.Final through 4.2.1... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100647 vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cac... |
high | 7.5 | — | Vllm / vllm | 2026-09-26 | 2026-10-06 |
| CVE-2026-100652 vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against voca... |
high | 7.5 | — | Vllm / vllm | 2026-09-26 | 2026-10-06 |
| CVE-2026-100641 SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before... |
high | 8.0 | — | — | 2026-09-26 | 2026-10-05 |
| CVE-2026-100642 SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery v... |
high | 7.6 | — | — | 2026-09-26 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.