September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-93659 Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields... |
high | 8.1 | — | — | 2026-09-18 | 2026-09-28 |
| CVE-2026-93576 A flaw was found in Netty netty-codec-smtp. |
high | 7.5 | — | — | 2026-09-18 | 2026-09-25 |
| CVE-2026-93652 Integer overflow in µD3TN v0.15.0 TCPCLv3 handshake causes heap overflow, allowi... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-93565 A flaw was found in Netty RtspDecoder. |
high | 7.5 | — | — | 2026-09-18 | 2026-10-15 |
| CVE-2026-93567 A flaw was found in Netty's HTTP/2 codec. |
high | 7.5 | — | — | 2026-09-18 | 2026-10-19 |
| CVE-2026-93568 A flaw was found in Netty. |
high | 7.5 | — | — | 2026-09-18 | 2026-10-19 |
| CVE-2026-93569 A flaw was found in Netty. |
high | 8.2 | — | — | 2026-09-18 | 2026-10-19 |
| CVE-2026-93558 A flaw was found in Netty's WebSocketServerExtensionHandler. |
high | 7.5 | — | — | 2026-09-18 | 2026-10-15 |
| CVE-2026-93564 A flaw was found in Netty. |
high | 7.5 | — | — | 2026-09-18 | 2026-10-15 |
| CVE-2026-77929 ClipBucket v5 before 5.5.3-#182 contains a file upload vulnerability that allows... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93604 vm2 through 3.12.0 exposes Node.js's crypto.setFips() function to untrusted gues... |
high | 7.2 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-93597 ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in th... |
high | 7.7 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-93599 rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93591 SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph... |
high | 7.6 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-93592 vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the... |
high | 7.5 | — | Vllm / vllm | 2026-09-18 | 2026-09-28 |
| CVE-2026-93593 ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for Tim... |
high | 8.1 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93594 ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 enforces i... |
high | 8.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-93589 ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in th... |
high | 7.5 | — | Imagemagick / imagemagick | 2026-09-18 | 2026-10-29 |
| CVE-2026-93590 ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR e... |
high | 7.5 | — | Imagemagick / imagemagick | 2026-09-18 | 2026-10-16 |
| CVE-2026-93560 A flaw was found in the Netty STOMP codec. |
high | 7.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-88622 NUUO Network Video Recorder 2.0.0 is vulnerable to Command Injection in handle_i... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-88623 NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. |
high | 7.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2023-5778 Improper handling of length parameter inconsistency vulnerability in ABB Freelan... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-93491 A flaw was found in Netty's HttpServerCodec. |
high | 7.5 | — | — | 2026-09-18 | 2026-10-15 |
| CVE-2026-93488 A flaw was found in Netty. |
high | 7.5 | — | — | 2026-09-18 | 2026-10-15 |
| CVE-2026-28197 An authenticated, low-privileged user with access to the NetBackup Flex
OS mana... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-28198 An authenticated, low-privileged user with access to the NetBackup Flex
OS mana... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-93575 A flaw was found in Netty's MqttDecoder. |
high | 7.5 | — | — | 2026-09-18 | 2026-09-25 |
| CVE-2026-93563 A flaw was found in Netty's `SmtpResponseDecoder` component. |
high | 7.5 | — | — | 2026-09-18 | 2026-09-25 |
| CVE-2026-93572 A flaw was found in Netty's `RedisArrayAggregator` component. |
high | 7.5 | — | — | 2026-09-18 | 2026-09-25 |
| CVE-2026-81627 A flaw was found in QEMU. |
high | 8.2 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-87743 A flaw was found in Quarkus HTTP security. |
high | 7.5 | — | — | 2026-09-18 | 2026-10-29 |
| CVE-2026-87915 The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimat... |
high | 7.2 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-18405 The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates f... |
high | 7.2 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-6205 An external control of file name or path vulnerability in Upload API in Synology... |
high | 8.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-83561 The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable... |
high | 7.2 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-85410 The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder,... |
high | 8.1 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-40539 An improper certificate validation vulnerability in Email API in Synology DiskSt... |
high | 7.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-40530 An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in... |
high | 8.0 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-13673 An incorrect permission assignment for critical resource vulnerability in LDAP A... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.