September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,827
Low
527
Severity not reported
2,543
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100643 SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View... |
high | 8.0 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100644 SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query e... |
high | 7.5 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100645 SiYuan versions 3.7.0 before 3.8.4 contain a stored cross-site scripting vulnera... |
high | 8.0 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100646 SiYuan is a self-hosted personal knowledge management system. |
high | 8.1 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100636 SiYuan versions before v3.8.4 contain a path traversal vulnerability in the expo... |
high | 7.6 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100637 SiYuan versions before v3.8.4 contain a path traversal vulnerability in the chec... |
high | 7.6 | — | — | 2026-09-26 | 2026-10-05 |
| CVE-2026-100638 SiYuan versions before v3.8.4 contain a path traversal vulnerability in the setN... |
high | 7.6 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100639 SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gu... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100631 Parse Server is an open source backend server. |
high | 7.5 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100622 capgo.app through 12.129.0 fails to verify deletion status when serving cached b... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100623 Capgo (capgo.app) exposes the legacy membership table public.org_users directly... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100625 Capgo (capgo.app) exposes a native build TUS upload proxy (supabase/functions/_b... |
high | 7.1 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100627 Capgo (Cap-go/capgo.app) server backend Supabase functions contain an incorrect... |
high | 8.1 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100614 Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the met... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100615 Cap-go capgo.app before 12.267.1 fails to validate target API key privilege duri... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100617 Cap-go capgo.app fails to validate that principals in channel_permission_overrid... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100618 Capgo (capgo.app) is affected by an authorization flaw in the app icon update pa... |
high | 8.5 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100619 Capgo (capgo.app) blocks direct user inserts into the public.manifest table with... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100608 Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboa... |
high | 8.3 | — | — | 2026-09-26 | 2026-10-05 |
| CVE-2026-100610 Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/u... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100612 Capgo (capgo.app) through version 12.261.0 contains an incomplete access-control... |
high | 7.2 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100605 Flowise through 3.1.4 contains missing route-level RBAC checks on chat message e... |
high | 7.1 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100606 Flowise through 3.1.4 (Enterprise/platform mode with SSO enabled) contains an au... |
high | 7.7 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100607 Flowise through 3.1.4 resolves SSO and local-password users solely by email with... |
high | 7.7 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100315 A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5d... |
high | 7.3 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100314 A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Pr... |
high | 7.3 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-98163 In the Linux kernel, the following vulnerability has been resolved:
cgroup: Avo... |
high | 7.0 | — | Linux / linux kernel | 2026-09-26 | 2026-10-19 |
| CVE-2026-96524 The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly ve... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-96532 The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capabi... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-84095 The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capa... |
high | 8.0 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-84096 The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capa... |
high | 8.0 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-85081 The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin b... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-16591 The WP Directory Kit WordPress plugin before 1.5.8 does not sanitize and escape... |
high | 7.2 | — | — | 2026-09-26 | 2026-09-26 |
| CVE-2026-100596 OpenClaw versions before 2026.7.1 fail to properly authorize non-owner users exe... |
high | 8.8 | — | — | 2026-09-26 | 2026-10-05 |
| CVE-2026-100597 OpenClaw (npm package 'openclaw') before 2026.7.1 is vulnerable to a time-of-che... |
high | 7.8 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100598 OpenClaw (npm package openclaw) before 2026.7.1 incorrectly binds Signal approva... |
high | 7.1 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100599 OpenClaw versions 2026.5.1 through 2026.7.0 fail to apply the configured exec ap... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100589 OpenClaw versions before 2026.7.1 contain a sandbox bypass vulnerability in the... |
high | 8.3 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100585 OpenClaw (npm package `openclaw`) before 2026.7.1 fails to enforce the owner-onl... |
high | 8.0 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100586 OpenClaw Codex before 2026.7.1 fails to properly enforce owner authorization whe... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.