September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-81656 IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability... |
high | 8.8 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-75895 In libsmpp35 from 0.1.0 through 1.8.0 out of bound read issue was found in the a... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-30 |
| CVE-2026-61820 pg_partman is a PostgreSQL extension that manages partitioned tables by time or... |
high | 8.5 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-61821 pg_partman is a PostgreSQL extension that manages partitioned tables by time or... |
high | 8.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-61817 pg_partman is a PostgreSQL extension that manages partitioned tables by time or... |
high | 8.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-61818 pg_partman is a PostgreSQL extension that manages partitioned tables by time or... |
high | 8.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-61819 pg_partman is a PostgreSQL extension that manages partitioned tables by time or... |
high | 8.5 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-61714 FluidSynth is a software synthesizer based on the SoundFont 2 specifications. |
high | 7.8 | — | — | 2026-09-18 | 2026-09-25 |
| CVE-2026-61721 FluidSynth is a software synthesizer based on the SoundFont 2 specifications. |
high | 8.0 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-17619 IBM Platform RTM is vulnerable to SQL injection. |
high | 8.6 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-11727 IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 IBM MQ C client could allow a remo... |
high | 8.1 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-11725 IBM MQ could allow an authenticated attacker to cause a denial of service or pot... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-11726 IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attac... |
high | 8.1 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-11716 IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attac... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2017-20284 Caucho Resin contains a path traversal vulnerability in the documentation webapp... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-75893 In osmo-bsc from 1.0.1 through 1.14.1 a heap based buffer overflow issue was fou... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-75894 In osmo-iuh from 0.1.0 through 1.8.0 a reachable assertion was found in the rana... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2021-48008 Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2019-25776 Weaver E-cology contains an unauthenticated SQL injection vulnerability that all... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93752 CSSOM through 0.5.0 contains a denial of service vulnerability in CSSStyleDeclar... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93753 deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the merg... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-93759 Mongoid does not neutralize a string-typed query criterion supplied to its query... |
high | 8.6 | — | Mongodb / mongoid | 2026-09-18 | 2026-09-24 |
| CVE-2026-93760 Mongoid does not restrict which query operators may come from caller-supplied fi... |
high | 8.2 | — | Mongodb / mongoid | 2026-09-18 | 2026-09-24 |
| CVE-2026-93761 An inefficient regular expression complexity issue in the in-memory query evalua... |
high | 7.5 | — | Mongodb / mongoid | 2026-09-18 | 2026-09-24 |
| CVE-2026-93748 http-cache-semantics through 4.2.0 fails to properly validate security-zeroed ca... |
high | 7.5 | — | — | 2026-09-18 | 2026-10-14 |
| CVE-2026-93749 source-map-js through 1.2.1 fails to validate the per-section offset line value... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-91127 File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other... |
high | 8.2 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-84975 PJSIP is a free and open source multimedia communication library written in C. |
high | 7.4 | — | Teluu / pjsip | 2026-09-18 | 2026-10-20 |
| CVE-2026-85058 Moquette is a lightweight Java MQTT broker. |
high | 7.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-81179 SysReptor is a fully customizable pentest reporting platform. |
high | 8.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-81180 SysReptor is a fully customizable pentest reporting platform. |
high | 8.8 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-77396 PJSIP is a free and open source multimedia communication library written in C. |
high | 7.1 | — | Teluu / pjsip | 2026-09-18 | 2026-10-16 |
| CVE-2026-69184 c-ares is an asynchronous resolver library. |
high | 7.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-61552 Icinga 2 is an open source monitoring system. |
high | 7.2 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-62278 LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel... |
high | 8.1 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-62279 LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel... |
high | 7.1 | — | — | 2026-09-18 | 2026-09-30 |
| CVE-2026-61551 Icinga 2 is an open source monitoring system. |
high | 8.6 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-32641 Parseable is a log analytics platform built for high-volume data ingestion and a... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-33625 LMDeploy is a toolkit for compressing, deploying, and serving large language mod... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-93758 An insecure direct object reference in the nested attributes handling of the Mon... |
high | 8.1 | — | Mongodb / mongoid | 2026-09-18 | 2026-09-25 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.