September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-19438 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-14321 The divi-dash WordPress plugin before 1.0.7 does not validate the source of the... |
high | 8.2 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2022-4997 The jet-form-builder-stripe-gateway WordPress plugin before 1.1.0 does not sanit... |
high | 8.6 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-89425 UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds t... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-91776 TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches th... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-91777 Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jacks... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-95927 A vulnerability was identified in SourceCodester Online Reviewer Management Syst... |
high | 7.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95926 A vulnerability was determined in SourceCodester Online Reviewer Management Syst... |
high | 7.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95924 A vulnerability has been found in SourceCodester Online Reviewer Management Syst... |
high | 7.3 | — | — | 2026-09-23 | 2026-09-26 |
| CVE-2026-95925 A vulnerability was found in SourceCodester Online Reviewer Management System 1.... |
high | 7.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-96271 Photoview through 2.4.0 contains an authorization bypass vulnerability in the sh... |
high | 7.1 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96272 ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability in... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-26 |
| CVE-2026-94367 OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains an OS comm... |
high | 7.2 | — | — | 2026-09-23 | 2026-09-26 |
| CVE-2026-18176 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
high | 7.4 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-07 |
| CVE-2026-61685 ReactPress is a publishing system for React developers. |
high | 7.5 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-18172 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
high | 7.4 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-07 |
| CVE-2026-95819 A vulnerability has been found in anirbandutta9 College-Notes-Gallery up to 8c1c... |
high | 7.3 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-18134 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
high | 7.5 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-07 |
| CVE-2026-18137 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
high | 8.1 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-07 |
| CVE-2026-18152 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
high | 7.5 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-08 |
| CVE-2026-18153 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
high | 7.1 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-08 |
| CVE-2026-18154 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
high | 7.5 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-08 |
| CVE-2026-18066 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local... |
high | 7.1 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-08 |
| CVE-2026-18074 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
high | 7.5 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-07 |
| CVE-2026-18095 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
high | 8.8 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-07 |
| CVE-2026-18114 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
high | 7.5 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-07 |
| CVE-2026-18123 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
high | 7.5 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-07 |
| CVE-2026-17636 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
high | 8.8 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-08 |
| CVE-2026-17637 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow an adja... |
high | 8.8 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-08 |
| CVE-2026-17643 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local... |
high | 7.1 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-08 |
| CVE-2026-17644 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local... |
high | 7.1 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-08 |
| CVE-2026-17645 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
high | 8.8 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-08 |
| CVE-2026-17647 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local... |
high | 8.8 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-08 |
| CVE-2026-16468 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-22 | 2026-09-25 |
| CVE-2026-16469 IBM DataStage on Cloud Pak for Data 5.4.0.0 px-runtime could allow a remote auth... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-22 | 2026-09-25 |
| CVE-2026-16672 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-22 | 2026-09-25 |
| CVE-2026-17102 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-22 | 2026-09-25 |
| CVE-2026-17620 IBM Financial Transaction Manager (FTM) for RedHat OpenShift 4.0.6.0 through 4.0... |
high | 7.5 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-15 |
| CVE-2026-95814 Vaultwarden through 1.37.3 omits organization membership status validation from... |
high | 8.1 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-91018 lwIP (Lightweight IP) has a double free vulnerability, which could crash the sys... |
high | 8.8 | — | — | 2026-09-22 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.