September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92815 changedetection.io through 0.60.6 fails to validate the Goto URL action in brows... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92816 ComfyUI before 0.30.0 fails to sanitize folder_name input in dataset save nodes,... |
high | 7.8 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92804 Nango through 0.70.4 fails to validate caller-supplied connection configuration... |
high | 7.1 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92806 phpList versions before 3.6.17 fail to validate cross-site request forgery token... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92794 OpenSign through 2.41.3 fails to validate caller identity in the getDocument clo... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92796 Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions for... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92801 cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the on... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92788 Coze Studio through 0.5.1 fails to validate that table names in workflow SQL cus... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92791 Uber Kraken through 0.1.29 fails to validate the tag parameter in the /tags/{tag... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92792 OpenNHP through 1.0.2 selects its trusted-execution attestation verifier based o... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92793 GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92782 Chroma through 1.5.9 fails to validate tenant and database segments when resolvi... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92783 Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/r... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92784 @refinedev/inferencer through 7.0.0 fails to escape API field names when interpo... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92785 Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo wit... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92786 LightGBM through 4.7.0 fails to validate child and split array values when parsi... |
high | 7.8 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92773 Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a G... |
high | 7.1 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92776 Wiki.js through 2.5.314 fails to require path separators when matching START and... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92779 Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pol... |
high | 7.6 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92780 KnowStreaming through 3.4.1 fails to enforce role-based access control on REST A... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92763 Rundeck through 6.2.1 fails to properly authorize the importConfig and importNod... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92772 Leantime before 3.9.6 contains an authorization bypass vulnerability in the HTMX... |
high | 7.1 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-92752 metasfresh DocumentAttachmentsRestController and CommentsRestController endpoint... |
high | 8.3 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92753 PatrowlManager through 1.8.4 contains an authorization bypass vulnerability in t... |
high | 7.1 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92761 WebVirtCloud fails to properly validate permission flags in UserInstance grants,... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92762 Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions onl... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92748 BC Security Empire before 6.7.1 fails to validate the multipart filename paramet... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92749 SafeLine through 9.4.1 derives the management console session-signing secret fro... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92751 CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allow... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-76425 A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote at... |
high | 7.6 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-63506 Tina is a headless content management system. |
high | 8.8 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-76409 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-76412 A vulnerability in the remote diagnostics debugger of Cisco Secure FMC Software... |
high | 8.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-76413 A vulnerability in Cisco Adaptive Security Device Manager (ASDM) single sign-on... |
high | 8.2 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-76424 A vulnerability in the REST API of Cisco ISE could allow an authenticated, remot... |
high | 7.2 | — | Cisco / identity services engine | 2026-09-16 | 2026-09-28 |
| CVE-2026-20352 A vulnerability in the RADIUS feature of Cisco Identity Services Engine (ISE) co... |
high | 8.6 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20360 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20335 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20336 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20340 A vulnerability in Cisco Secure FMC Software could allow an authenticated, remot... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.