September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-75939 A flaw was found in openshift/oc-mirror. |
high | 7.4 | — | — | 2026-09-21 | 2026-10-15 |
| CVE-2026-61628 nginx ignition is a user interface for the nginx web server. |
high | 8.1 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-61629 nginx ignition is a user interface for the nginx web server. |
high | 7.5 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-55071 MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safe... |
high | 8.4 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-55567 BleachBit cleans files to free disk space and to maintain privacy. |
high | 7.8 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-88806 A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 dur... |
high | 7.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2025-71421 UVdesk core-framework before 1.1.7 contains an improper privilege management vul... |
high | 7.2 | — | — | 2026-09-21 | 2026-10-14 |
| CVE-2026-84285 An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 1... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94368 A flaw was found in the signature verification logic of noobaa-core, the core co... |
high | 7.1 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-91866 A specially crafted pair of WS-Policy documents can force Neethi's policy-inters... |
high | 7.5 | — | Apache / neethi | 2026-09-21 | 2026-09-25 |
| CVE-2026-91863 A specially crafted WS-Policy document with deeply nested policy elements can by... |
high | 7.5 | — | Apache / neethi | 2026-09-21 | 2026-09-24 |
| CVE-2026-91864 A specially crafted WS-Policy document can pack unlimited content inside a polic... |
high | 7.5 | — | Apache / neethi | 2026-09-21 | 2026-09-25 |
| CVE-2026-91865 A small WS-Policy document using repeated policy references can force Neethi to... |
high | 7.5 | — | Apache / neethi | 2026-09-21 | 2026-09-25 |
| CVE-2026-92574 A vulnerability in CRI-O checkpoint restore allows a user who can create a pod f... |
high | 8.8 | — | — | 2026-09-21 | 2026-10-01 |
| CVE-2026-15801 A vulnerability was found in CRI-O related to the container checkpoint and resto... |
high | 8.0 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-47321 The CompressionFilter class uses ZLib to deflate and inflate data sent and recei... |
high | 7.5 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-90860 The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers r... |
high | 7.1 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94144 A flaw has been found in drogonframework drogon up to 1.9.13. |
high | 7.3 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-94146 A vulnerability was found in BioStar BIOS Update Utility 1.9.7.3. |
high | 8.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94143 A vulnerability was detected in drogonframework drogon up to 1.9.13. |
high | 7.3 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94142 A security vulnerability has been detected in BioStar Temperature Monitor Utilit... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94139 A weakness has been identified in Chengdu Feiyuxing Technology Feiyu Star Router... |
high | 7.4 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94128 A security vulnerability has been detected in BioStar VIVID LED DJ 4.0.2411.1500... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94129 A vulnerability was detected in BioStar VALKYRIE AURORA 2.10.2411.0800. |
high | 8.8 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94110 A security vulnerability has been detected in QCMS up to 6.0.6. |
high | 7.3 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94044 A vulnerability was identified in 03-lovepreetSingh MCP up to f95d035c5317fad81a... |
high | 7.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94038 A security vulnerability has been detected in NonceGeek dim-sum-app. |
high | 7.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94039 A vulnerability was detected in vas3k TaxHacker up to 0.8.5. |
high | 7.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94036 A security flaw has been discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0... |
high | 8.8 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94015 A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. |
high | 7.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-94106 getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out... |
high | 8.8 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-94107 NivoCart through 2.4.0 contains a predictable password reset token vulnerability... |
high | 8.1 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-94109 openEQUELLA before 2026.1.0 contains an authenticated stored server-side templat... |
high | 8.0 | — | — | 2026-09-20 | 2026-10-29 |
| CVE-2026-93997 A weakness has been identified in SourceCodester Drug Recommendation System 1.0. |
high | 7.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94004 A vulnerability was found in DedeCMS up to 5.7.118. |
high | 7.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94104 NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the Fi... |
high | 8.8 | — | — | 2026-09-20 | 2026-09-24 |
| CVE-2026-93979 A security flaw has been discovered in code-projects Internship Management Syste... |
high | 7.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-93980 A weakness has been identified in code-projects Internship Management System 1.0... |
high | 7.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-93978 A vulnerability was identified in code-projects Internship Management System 1.0... |
high | 7.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-93973 A vulnerability was detected in SourceCodester Online Reviewer Management System... |
high | 7.3 | — | — | 2026-09-20 | 2026-09-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.