September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-78501 Improper neutralization of special elements used in a command ('command injectio... |
high | 8.6 | — | Microsoft / 365 copilot chat | 2026-09-17 | 2026-10-14 |
| CVE-2026-77903 Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized... |
high | 8.1 | — | Microsoft / dataverse | 2026-09-17 | 2026-09-25 |
| CVE-2026-68791 Incorrect authorization in Azure Machine Learning allows an unauthorized attacke... |
high | 7.5 | — | Microsoft / azure machine learning | 2026-09-17 | 2026-09-25 |
| CVE-2026-93426 SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry fie... |
high | 8.5 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-54671 WeGIA is a web manager for charitable institutions. |
high | 8.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-54646 CubeCart is an ecommerce software solution. |
high | 7.2 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-54647 CubeCart is an ecommerce software solution. |
high | 7.2 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54520 AI Agent Automation is a modular AI agent workflow automation platform with sche... |
high | 8.1 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54612 Vvveb is a powerful and easy to use CMS with page builder to build websites, blo... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-54634 Hamlib is a ham radio control library for radios, rotators, and amplifiers. |
high | 7.3 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54506 Vvveb is a powerful and easy to use CMS with page builder to build websites, blo... |
high | 7.6 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-54519 AI Agent Automation is a modular AI agent workflow automation platform with sche... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-50158 yutu is an AI-powered toolkit for managing and growing YouTube channels. |
high | 7.7 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-93393 A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C... |
high | 8.1 | — | Mongodb / c driver | 2026-09-17 | 2026-09-29 |
| CVE-2026-93377 Type confusion in V8 in Google Chrome prior to 153.0.8010.52 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-93381 Buffer overflow in PDFium in Google Chrome on on Windows prior to 153.0.8010.52... |
high | 8.8 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-93382 Use after free in PDFium in Google Chrome prior to 153.0.8010.52 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-09-17 | 2026-09-19 |
| CVE-2026-93375 Incorrect reference resolution in Tracing in Google Chrome on on Windows prior t... |
high | 8.1 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-86049 Jupyter Server is the backend for Jupyter web applications. |
high | 7.1 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-77615 Paella Player is a set of libraries to create a multi stream video player. |
high | 8.7 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-76154 A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base... |
high | 7.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-68523 `fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that process... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-68537 `fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that process... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54916 NetBox Device Type Library is a collection of community-sourced device type defi... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54510 Speakr is a personal, self-hosted web application designed for transcribing audi... |
high | 7.1 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-54596 ITFlow provides an IT documentation, ticketing and accounting system for small m... |
high | 8.1 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-54597 ITFlow provides an IT documentation, ticketing and accounting system for small m... |
high | 8.3 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54339 Glean is a self-hosted RSS reader and personal knowledge management tool. |
high | 7.7 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54354 MapServer is a system for developing web-based GIS applications. |
high | 8.2 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-50275 The Datadog PHP Tracer provides application performance monitoring and distribut... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-50277 dd-trace-cpp is the Datadog distributed tracing library for C++. |
high | 7.5 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-52483 The ping diagnostics and other similar functions of the MitraStar GPT-2741GNAC-N... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-15815 Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when
ex... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-93337 NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper input... |
high | 7.8 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-92943 Improper validation of certificate with host mismatch in the MQTT client TLS con... |
high | 8.1 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-54692 SAIL is a cross-platform library for loading and saving images with support for... |
high | 7.8 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54716 Valhalla is an open source routing engine and accompanying libraries for use wit... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-50125 MKP is a Model Context Protocol server for Kubernetes. |
high | 7.5 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-50285 Pomerium is an identity and context-aware access proxy. |
high | 7.5 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-45720 Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. |
high | 7.0 | — | — | 2026-09-17 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.