September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-94640 A flaw was found in rpcbind. |
high | 7.5 | — | — | 2026-09-22 | 2026-10-28 |
| CVE-2026-95653 Concrete CMS Community Store before 2.7.8 derives digital product download token... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-95654 Databasement before 1.7.14 validates invitation tokens only when the acceptance... |
high | 7.4 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-95655 Aureus ERP before 1.5.0 fails to scope message lookups to the current record in... |
high | 8.1 | — | — | 2026-09-22 | 2026-09-28 |
| CVE-2026-80148 Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EM... |
high | 8.6 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-80149 Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EM... |
high | 8.6 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-80150 Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EM... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-77633 Cloudreve is a self-hosted file management and sharing system. |
high | 7.1 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-75607 Frigate is an open source network video recorder. |
high | 8.1 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-75608 Frigate is an open source network video recorder. |
high | 7.7 | — | — | 2026-09-22 | 2026-09-28 |
| CVE-2026-70410 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection... |
high | 8.8 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-56681 9Router is an AI router & token saver. |
high | 7.3 | — | — | 2026-09-22 | 2026-09-28 |
| CVE-2026-95500 A vulnerability has been found in JosephChuks php-file-manager-with-code-editor... |
high | 7.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-89407 NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stri... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-79314 A horizontal privilege escalation vulnerability exists in x-ui 0.3.2. |
high | 8.8 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-65128 NVIDIA Infrastructure Controller for Linux contains a vulnerability where an att... |
high | 8.8 | — | Nvidia / infra controller | 2026-09-22 | 2026-09-29 |
| CVE-2026-65129 NVIDIA Infrastructure Controller for Linux contains a vulnerability where an att... |
high | 8.3 | — | Nvidia / infra controller | 2026-09-22 | 2026-09-29 |
| CVE-2026-65178 NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a mal... |
high | 7.8 | — | Nvidia / nemo speech | 2026-09-22 | 2026-09-29 |
| CVE-2026-65179 NVIDIA NeMo contains a vulnerability in the TabularTokenizer class where it dese... |
high | 8.8 | — | Nvidia / nemo speech | 2026-09-22 | 2026-09-29 |
| CVE-2026-65117 NVIDIA Infrastructure Controller for Linux contains a vulnerability where an att... |
high | 8.8 | — | Nvidia / infra controller | 2026-09-22 | 2026-09-29 |
| CVE-2026-65124 NVIDIA Infrastructure Controller for Linux contains a vulnerability where an att... |
high | 8.1 | — | Nvidia / infra controller | 2026-09-22 | 2026-09-29 |
| CVE-2026-65125 NVIDIA Infrastructure Controller for Linux contains a vulnerability where an att... |
high | 8.8 | — | Nvidia / infra controller | 2026-09-22 | 2026-09-29 |
| CVE-2026-65126 NVIDIA Infrastructure Controller for Linux contains a vulnerability where an att... |
high | 8.8 | — | Nvidia / infra controller | 2026-09-22 | 2026-09-29 |
| CVE-2026-65111 NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious in... |
high | 7.8 | — | Nvidia / nemo speech | 2026-09-22 | 2026-09-25 |
| CVE-2026-24239 NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious da... |
high | 7.8 | — | Nvidia / nemo speech | 2026-09-22 | 2026-09-25 |
| CVE-2026-24267 NVIDIA NeMo Speech for all platforms contains a vulnerability in the speech data... |
high | 7.8 | — | Nvidia / nemo speech | 2026-09-22 | 2026-09-25 |
| CVE-2026-95499 A flaw has been found in JosephChuks php-file-manager-with-code-editor up to 3.0... |
high | 7.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95619 A flaw was found in libstdc++. |
high | 7.7 | — | — | 2026-09-22 | 2026-10-26 |
| CVE-2026-95271 A vulnerability has been found in dgtlmoon changedetection.io up to 0.60.7. |
high | 7.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-75791 Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerab... |
high | 8.6 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-94117 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-25264 Privilege escalation due to weak configuration during package extraction process... |
high | 8.8 | — | Qualcomm / software center | 2026-09-22 | 2026-09-25 |
| CVE-2026-25265 Privilege escalation due to weak configuration while temporary file handling. |
high | 8.8 | — | Qualcomm / software center | 2026-09-22 | 2026-09-25 |
| CVE-2026-25255 Exposed dangerous function lead to privilege escalation via gRPC server. |
high | 7.8 | — | Qualcomm / package manager | 2026-09-22 | 2026-10-06 |
| CVE-2026-95508 A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders... |
high | 7.4 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-9231 The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for W... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-93928 Authentication Bypass Using an Alternate Path or Channel vulnerability in Magepe... |
high | 7.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-93778 The WP Yelp Review Slider plugin for WordPress is vulnerable to Stored Cross-Sit... |
high | 7.2 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-93836 The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to St... |
high | 7.2 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-92235 The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary short... |
high | 8.1 | — | — | 2026-09-22 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.