September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,827
Low
527
Severity not reported
2,543
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100208 Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorize... |
high | 8.1 | — | Microsoft / 365 apps | 2026-09-25 | 2026-10-28 |
| CVE-2026-97060 X-SpringBoot through 6.0 lacks object-level authorization in user management end... |
high | 7.2 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-97882 A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to... |
high | 7.3 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-97883 A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Pr... |
high | 7.3 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-97885 A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098... |
high | 7.3 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-91838 A flaw was found in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager. |
high | 7.8 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-91839 A flaw was found in NetworkManager-fortisslvpn, the FortiSSLVPN plugin for Netwo... |
high | 7.8 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-91840 A flaw was found in NetworkManager-vpnc. |
high | 7.8 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-91841 A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. |
high | 7.8 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-97871 A vulnerability has been found in Zhonglun CloudPos up to 3.0.1.76. |
high | 7.3 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-97877 A vulnerability was determined in zhistaredu StarTraining up to 3.8.1. |
high | 7.3 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-97878 A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. |
high | 7.3 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-94445 A malicious txtar could escape the intended execution context and force arbitrar... |
high | 8.8 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-89032 BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerabi... |
high | 7.7 | — | — | 2026-09-25 | 2026-10-01 |
| CVE-2026-91837 A flaw was found in NetworkManager-iodine, the iodine VPN plugin for NetworkMana... |
high | 7.8 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-67410 RabbitMQ is a messaging and streaming broker. |
high | 7.1 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-08 |
| CVE-2026-67411 RabbitMQ is a messaging and streaming broker. |
high | 7.1 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-08 |
| CVE-2026-67412 RabbitMQ is a messaging and streaming broker. |
high | 7.1 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-08 |
| CVE-2026-67407 RabbitMQ is a messaging and streaming broker. |
high | 7.1 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-16 |
| CVE-2026-67230 RabbitMQ is a messaging and streaming broker. |
high | 7.5 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-20 |
| CVE-2026-67223 RabbitMQ is a messaging and streaming broker. |
high | 7.1 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-15 |
| CVE-2026-67225 RabbitMQ is a messaging and streaming broker. |
high | 7.5 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-20 |
| CVE-2026-49850 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
high | 7.5 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-50547 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
high | 7.5 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-42323 Piwigo is a full featured open source photo gallery application for the web. |
high | 7.2 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-42324 Piwigo is a full featured open source photo gallery application for the web. |
high | 7.2 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-44642 Piwigo is a full featured open source photo gallery application for the web. |
high | 8.1 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-33639 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
high | 7.2 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-84862 IBM Guardium Data Protection 12.2 is vulnerable to insecure deserialization in t... |
high | 7.2 | — | Ibm / guardium data protection | 2026-09-25 | 2026-10-20 |
| CVE-2026-93306 IBM Server Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW... |
high | 7.1 | — | Ibm / power system e1080 \(9080-hex\) firmware | 2026-09-25 | 2026-09-30 |
| CVE-2026-97865 A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. |
high | 7.3 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-93834 A use-after-free vulnerability was found in QEMU's 9pfs subsystem. |
high | 8.8 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-85029 IBM Guardium Data Protection 12.2 could allow a remote attacker to obtain sensit... |
high | 8.8 | — | Ibm / guardium data protection | 2026-09-25 | 2026-10-20 |
| CVE-2026-85542 IBM Guardium Data Protection 12.2 is affected by a command injection vulnerabili... |
high | 8.8 | — | Ibm / guardium data protection | 2026-09-25 | 2026-10-20 |
| CVE-2026-85750 Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execu... |
high | 7.2 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-84884 IBM Guardium Data Protection 12.2 stores internal REST service-account passwords... |
high | 8.8 | — | Ibm / guardium data protection | 2026-09-25 | 2026-10-20 |
| CVE-2026-100072 In the Linux kernel, the following vulnerability has been resolved:
ACPI: platf... |
high | 7.8 | — | Linux / linux kernel | 2026-09-25 | 2026-10-21 |
| CVE-2026-79153 Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access contr... |
high | 7.8 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-88421 Incorrect access control in the BlogPage.get_entries() component of APSL puput v... |
high | 7.5 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-51773 An issue in the VMware datastore driver of OpenStack glance_store. |
high | 8.1 | — | — | 2026-09-25 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.