September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-81548 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-24 | 2026-10-06 |
| CVE-2026-81549 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 7.7 | — | Ibm / datastage on cloud pak for data | 2026-09-24 | 2026-10-06 |
| CVE-2026-77874 IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.... |
high | 8.6 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-58007 Untrusted pointer dereference vulnerability in Altera Trusted Firmware on HPS al... |
high | 8.1 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-58008 Stack-based buffer overflow vulnerability in Altera Trusted Firmware on HPS allo... |
high | 8.1 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-56736 phpMyFAQ is an open source FAQ web application. |
high | 8.2 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-58004 Out-of-bounds read vulnerability in Altera Trusted Firmware on HPS allows Privil... |
high | 8.1 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-58005 Out-of-bounds read vulnerability in Altera Trusted Firmware on HPS allows Privil... |
high | 8.1 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-58006 Untrusted pointer dereference vulnerability in Altera Trusted Firmware on HPS al... |
high | 8.1 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-51995 An issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to... |
high | 7.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-51997 An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to... |
high | 8.8 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-52001 An issue in geelen mcp-remote 0.1.18 through 0.1.38 allows a remote attacker to... |
high | 7.5 | — | — | 2026-09-24 | 2026-10-06 |
| CVE-2026-13465 Stack-based buffer overflow vulnerability in Altera Trusted Firmware on HPS allo... |
high | 8.1 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-13466 Incorrect calculation of buffer size vulnerability in Altera Trusted Firmware on... |
high | 8.1 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-13467 Out-of-bounds write vulnerability in Altera Trusted Firmware on HPS allows Explo... |
high | 8.1 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97057 redis-parser through 3.0.0 fails to validate the multi-bulk length value in RESP... |
high | 7.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97059 DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoad... |
high | 8.2 | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-95519 A flaw was found in rpm. |
high | 7.8 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-95521 A command injection flaw was found in rpm. |
high | 7.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-88360 libvips 8.19.0 contains a memory access vulnerability when processing little-end... |
high | 7.5 | — | — | 2026-09-24 | 2026-10-06 |
| CVE-2026-97182 A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. |
high | 7.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-88907 Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Authenti... |
high | 7.4 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-57590 A missing authorization vulnerability exists in the Task Group APIs of Apache Do... |
high | 8.1 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-78309 SQL Injection vulnerability in DIAEnergie. |
high | 8.8 | — | — | 2026-09-24 | 2026-10-15 |
| CVE-2026-78311 SQL Injection vulnerability in DIAEnergie. |
high | 8.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-85682 The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in al... |
high | 8.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97185 A flaw was found in GIMP. |
high | 7.8 | — | — | 2026-09-24 | 2026-10-19 |
| CVE-2026-77193 The eesy_ID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Pa... |
high | 7.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-88843 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not val... |
high | 7.2 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-80513 The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes m... |
high | 7.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96898 A vulnerability was detected in yhx070424 ShopXO up to 2.2.7. |
high | 7.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97055 SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret (to... |
high | 8.1 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96803 A vulnerability was identified in java110 MicroCommunity up to 2.0. |
high | 7.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96751 A vulnerability has been found in pmTicket Project-Management-Software up to 078... |
high | 7.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96762 A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. |
high | 7.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-92470 GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 bef... |
high | 7.7 | — | Gitlab / gitlab | 2026-09-24 | 2026-09-28 |
| CVE-2026-70125 Microsoft Office Outlook Remote Code Execution Vulnerability |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-23 | 2026-10-05 |
| CVE-2026-96603 A vulnerability has been found in Abdurrab5 online-makeup-store. |
high | 7.3 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96604 A vulnerability was identified in SoftNews Media Group DataLife Engine 18.0. |
high | 7.3 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-86583 The Import and export users and customers plugin for WordPress is vulnerable to... |
high | 8.8 | — | — | 2026-09-23 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.