September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-94498 Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions. |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94500 Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94168 Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.1... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94079 Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions. |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94080 Unauthenticated Broken Access Control in MarketKing <= 2.1.70 versions. |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94118 Contributor Cross Site Scripting (XSS) in Premium Blocks – Gutenberg Blocks for... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93620 Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versio... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93623 Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 v... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93772 Subscriber Cross Site Scripting (XSS) in wpForo Forum <= 3.1.5 versions. |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93513 Contributor Insecure Direct Object References (IDOR) in SiteSkite <= 2.1.7 versi... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93529 Contributor Broken Access Control in WSP MCP – AI Agents Connector <= 2.7.0 vers... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93618 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-77420 JLine is a Java library for handling console input. |
medium | 5.5 | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-77421 JLine is a Java library for handling console input. |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-71462 StringListPathField.to_internal_value() calls
os.path.exists() on unbounded use... |
medium | 4.1 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-71459 JobJobEventsChildrenSummary view has no model/parent_model. |
medium | 5.0 | — | — | 2026-09-23 | 2026-09-25 |
| CVE-2026-71460 /api/v2/config/ is protected only by IsAuthenticated. |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-71461 HostList.list() catches bare Exception and returns str(e)
verbatim. |
medium | 4.3 | — | — | 2026-09-23 | 2026-10-16 |
| CVE-2026-71458 URLModificationMiddleware resolves named-URL lookups
against unfiltered Model.o... |
medium | 5.0 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-55632 GoCD is a continuous deliver server. |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-88831 BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-25 |
| CVE-2026-88835 BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb... |
medium | 6.1 | — | — | 2026-09-23 | 2026-09-25 |
| CVE-2026-88837 BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Au... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-25 |
| CVE-2026-88839 BusyBox passwd/group tokenize() references a stale endpoint pointer after trimmi... |
medium | 6.7 | — | — | 2026-09-23 | 2026-09-25 |
| CVE-2026-88840 BusyBox TLS get_client_hello() reads past the end of the input buffer when parsi... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-26 |
| CVE-2026-86867 Cinnamon's Kotaemon (all versions up to and including v0.12.0) multi-user chat i... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96807 In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appi... |
medium | 4.0 | — | — | 2026-09-23 | 2026-09-26 |
| CVE-2026-96655 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability |
medium | 4.3 | Listed | Plex / Media Server | 2026-09-23 | 2026-10-21 |
| CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page V... |
medium | 6.5 | Listed | Plex / Media Server | 2026-09-23 | 2026-10-21 |
| CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability |
medium | 4.3 | Listed | Plex / Media Server | 2026-09-23 | 2026-10-21 |
| CVE-2026-96651 Plex Media Server before 1.43.3.10861 builds a file path from the url parameter... |
medium | 6.5 | — | Plex / media server | 2026-09-23 | 2026-09-29 |
| CVE-2026-6669 Missing upper bound on the key derivation iteration count accepted during SCRAM... |
medium | 5.9 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-96674 alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit a... |
medium | 4.4 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96672 Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Te... |
medium | 6.4 | — | — | 2026-09-23 | 2026-09-29 |
| CVE-2026-79304 CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-79306 CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-25 |
| CVE-2026-3626 IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to obtain sensitiv... |
medium | 5.3 | — | Ibm / concert | 2026-09-23 | 2026-09-28 |
| CVE-2026-6327 IBM Concert 1.0.0 through 3.0.0 could allow an unauthorized user to inject data... |
medium | 4.3 | — | Ibm / concert | 2026-09-23 | 2026-09-28 |
| CVE-2026-19267 IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to mi... |
medium | 6.2 | — | Ibm / financial transaction manager | 2026-09-23 | 2026-10-07 |
| CVE-2026-18505 IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to op... |
medium | 5.4 | — | Ibm / financial transaction manager | 2026-09-23 | 2026-10-07 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.