September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-97413 In the Linux kernel, the following vulnerability has been resolved:
RDMA/rtrs-s... |
critical | 9.8 | — | — | 2026-09-24 | 2026-10-03 |
| CVE-2026-88378 QuickJS commit 04be24600 contains a heap out-of-bounds write condition in JS_Rea... |
critical | 9.8 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-79766 Termix is a web-based server management platform with SSH terminal, tunneling, a... |
critical | 9.1 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-93425 Dokploy is a free, self-hostable Platform as a Service (PaaS). |
critical | 9.9 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-93228 In the Linux kernel, the following vulnerability has been resolved:
svcrdma: Re... |
critical | 9.1 | — | — | 2026-09-24 | 2026-10-21 |
| CVE-2026-93207 In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: Zer... |
critical | 9.8 | — | — | 2026-09-24 | 2026-10-19 |
| CVE-2026-88365 minimp3 commit ea99364f contains an integer overflow vulnerability in mp3dec_ski... |
critical | 9.8 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-88351 An integer overflow vulnerability exists in the MPack Node API in MPack 1.1.1 on... |
critical | 9.8 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-51996 An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to... |
critical | 9.8 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-51994 mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request... |
critical | 9.1 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-97359 HFS2 version 2.4.0 and earlier contains a template injection vulnerability in th... |
critical | 10.0 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-97360 HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access... |
critical | 10.0 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-19072 Velociraptor stores the compiled VQL in the hunt object internally to avoid havi... |
critical | 9.9 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-12227 The Visual Composer Website Builder plugin for WordPress is vulnerable to Local... |
critical | 9.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-78308 Improper Authentication vulnerability in DIAEnergie allows Authentication Bypass... |
critical | 9.8 | — | — | 2026-09-24 | 2026-10-15 |
| CVE-2026-78312 Path Traversal in DIAEnergie. |
critical | 9.1 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96891 A vulnerability was identified in D-Link DIR-825 3.00b32. |
critical | 9.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-18467 The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable... |
critical | 9.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-89078 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2... |
critical | 9.9 | — | Gitlab / gitlab | 2026-09-24 | 2026-09-28 |
| CVE-2026-93577 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2... |
critical | 9.9 | — | Gitlab / gitlab | 2026-09-24 | 2026-09-28 |
| CVE-2026-93352 Laravel-Mediable 7.0.0 before 7.0.2 contains an incomplete patch for CVE-2026-49... |
critical | 9.8 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-6928 IBM Concert 1.0.0 through 3.0.0 references or accesses memory after it has been... |
critical | 9.8 | — | Ibm / concert | 2026-09-23 | 2026-09-29 |
| CVE-2026-6721 IBM Concert 1.0.0 through 3.0.0 allows an unauthenticated remote attacker can su... |
critical | 9.8 | — | Ibm / concert | 2026-09-23 | 2026-09-28 |
| CVE-2026-67231 RabbitMQ is a messaging and streaming broker. |
critical | 9.1 | — | Broadcom / rabbitmq server | 2026-09-23 | 2026-10-19 |
| CVE-2026-84719 A flaw was found in the Ansible Automation Platform automation-controller. |
critical | 9.9 | — | — | 2026-09-23 | 2026-09-25 |
| CVE-2026-75884 A flaw was found in AWX. |
critical | 9.1 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-95601 Unauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions. |
critical | 9.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-84502 A flaw was found in Red Hat Ansible Automation Platform's automation-
controller... |
critical | 9.9 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-84474 A flaw was found in Red Hat Ansible Automation Platform's automation-
controller... |
critical | 9.9 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-77602 OpenC3 COSMOS provides the functionality needed to send commands to and receive... |
critical | 9.9 | — | — | 2026-09-23 | 2026-09-29 |
| CVE-2026-86930 An out-of-bounds read vulnerability in FileMaker Server for Linux allowed an att... |
critical | 9.1 | — | Claris / filemaker server | 2026-09-23 | 2026-10-05 |
| CVE-2026-86934 An authorization bypass vulnerability in the FileMaker Server Web Publishing Eng... |
critical | 9.1 | — | Claris / filemaker server | 2026-09-23 | 2026-10-05 |
| CVE-2026-96758 orval @orval/core before 8.28.0 contains a code injection vulnerability in the f... |
critical | 9.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-96759 orval before 8.29.0 fails to escape the operationId parameter when emitting it i... |
critical | 9.8 | — | — | 2026-09-23 | 2026-09-29 |
| CVE-2026-96754 orval versions before 8.29.0 contain a code injection vulnerability in the @orva... |
critical | 9.8 | — | — | 2026-09-23 | 2026-09-29 |
| CVE-2026-96755 orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in t... |
critical | 9.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-96757 orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them i... |
critical | 9.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95848 Moquette is a lightweight Java MQTT broker. |
critical | 9.1 | — | Moquette / moquette | 2026-09-23 | 2026-09-28 |
| CVE-2026-85724 Moquette is a lightweight Java MQTT broker. |
critical | 9.6 | — | Moquette / moquette | 2026-09-23 | 2026-09-25 |
| CVE-2025-63564 SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allo... |
critical | 9.8 | — | — | 2026-09-23 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.