September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-47094 SIMAC MyPHR 1.1 contains an insecure direct object reference (IDOR) vulnerabilit... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92405 A security vulnerability has been detected in SourceCodester Inventory and Monit... |
high | 7.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-92602 TDuck survey form through version 5.3 fails to validate webhook URLs or verify f... |
high | 7.1 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92399 A vulnerability was determined in GPAC 26.07.0. |
high | 7.3 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92401 A vulnerability was identified in ChangeWeDer crm up to c07bd4c97141521af6475034... |
high | 7.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-85756 SSH.NET is a Secure Shell (SSH) library for .NET. |
high | 7.5 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-86358 Dell Update Package Framework, versions prior to 26.07.03, contains a Stack-base... |
high | 8.8 | — | Dell / update package framework | 2026-09-16 | 2026-09-21 |
| CVE-2026-86359 Dell Repository Manager, versions prior to 3.5.2, contains an Incorrect Default... |
high | 8.5 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-85731 oras-go is a Go library for managing OCI artifacts. |
high | 8.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-71180 Dell Update Package Framework, versions prior to 26.07.03, contains an Unchecked... |
high | 7.8 | — | Dell / update package framework | 2026-09-16 | 2026-09-21 |
| CVE-2026-71179 Dell Update Package Framework, versions prior to 26.07.03, contains an Improper... |
high | 7.8 | — | Dell / update package framework | 2026-09-16 | 2026-09-21 |
| CVE-2026-68904 node-opcua is an OPC UA implementation for TypeScript and Node.js. |
high | 7.0 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-59974 Stanza is a Stanford NLP Python library for tokenization, sentence segmentation,... |
high | 7.8 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-42784 A flaw was found in sequoia-openpgp. |
high | 7.4 | — | — | 2026-09-16 | 2026-10-15 |
| CVE-2026-92625 Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92626 Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-61595 djust provides Phoenix LiveView-style reactive server-side rendering for Django... |
high | 7.7 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-61593 djust provides Phoenix LiveView-style reactive server-side rendering for Django... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-17526 Keycloak is an open-source identity and access management solution. |
high | 7.2 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-92566 DataGear through 6.0.0 contains a server-side request forgery vulnerability in t... |
high | 8.2 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92366 A vulnerability was determined in code-projects Matrimonial System 1.0. |
high | 7.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-92380 A flaw has been found in WuzhiCMS up to 4.1.0. |
high | 7.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-92087 @fastify/auth is a Fastify plugin that composes multiple authentication and auth... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-88064 Backstage is an open framework for building developer portals. |
high | 8.8 | — | Linuxfoundation / backstage plugin-techdocs-node | 2026-09-16 | 2026-10-14 |
| CVE-2026-84858 ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Remote... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-84860 ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-84997 react/http is an event-driven, streaming HTTP client and server implementation f... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-82964 Improper preservation of permissions in the Avast sandbox minifilter driver (asw... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-79651 A flaw was found in the theme localization endpoints of the keycloak-services co... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-80274 If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the... |
high | 7.5 | — | — | 2026-09-16 | 2026-10-26 |
| CVE-2026-76825 RestrictedPython is a tool that helps define a subset of the Python language for... |
high | 8.4 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-74909 Keycloak provides a policy enforcer to protect applications by matching incoming... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-76163 If BIND is loaded with a "`named.conf`" file that contains no global "`options`"... |
high | 7.5 | — | — | 2026-09-16 | 2026-10-26 |
| CVE-2026-63671 MDC is a tool to take regular Markdown and write documents interacting deeply wi... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-63127 RMCP is an official Rust SDK for the Model Context Protocol. |
high | 8.2 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-63128 RMCP is an official Rust SDK for the Model Context Protocol. |
high | 7.5 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-18212 A flaw was found in the SAML Redirect Binding implementation of Keycloak, an ope... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-19666 On a resolver configured to use ``dns64``, if an applicable answer from the auth... |
high | 7.5 | — | — | 2026-09-16 | 2026-10-26 |
| CVE-2026-92466 zlt2000 microservices-platform through 6.0.0 contains a missing authorization vu... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-92467 zlt2000 microservices-platform through 6.0.0 contains an unverified password cha... |
high | 8.3 | — | — | 2026-09-16 | 2026-09-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.