September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-18364 The zportals WordPress plugin before 6.4.2 does not perform any capability or no... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-18365 The zportals WordPress plugin before 6.4.2 does not perform any capability or no... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-77765 The Better Payment WordPress plugin before 2.3.4 does not validate the submitted... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-77766 The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPr... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2025-15696 The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape seve... |
medium | 6.8 | — | — | 2026-09-23 | 2026-10-14 |
| CVE-2026-16264 The Newsletters WordPress plugin before 4.18.1 does not perform an ownership che... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-96258 A vulnerability has been found in onSite internet GmbH Auktion NG Auktionssoftwa... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-26 |
| CVE-2026-95929 A weakness has been identified in iFlytek astron-agent up to 1.0.7. |
medium | 6.3 | — | — | 2026-09-23 | 2026-09-26 |
| CVE-2026-95930 A security vulnerability has been detected in iFlytek astron-agent up to 1.0.6. |
medium | 6.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95957 A vulnerability was found in SourceCodester Smart Attendance System with QR Code... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95928 A security flaw has been discovered in recommenders-team recommenders up to 1.2.... |
medium | 5.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-96273 Ghidra before 12.1.4 fails to validate the TYPE_COL byte in OptionsDB.createUnre... |
medium | 5.5 | — | — | 2026-09-23 | 2026-09-28 |
| CVE-2026-95897 A security vulnerability has been detected in Dask up to 2026.8.0. |
medium | 5.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-92930 OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 uses an administrat... |
medium | 6.2 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-95829 A vulnerability was identified in TDuckCloud tduck-platform up to 5.3. |
medium | 6.3 | — | — | 2026-09-23 | 2026-09-26 |
| CVE-2026-95830 A security flaw has been discovered in theRealSain Pixtream up to 866afd4f0cea81... |
medium | 6.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95833 A weakness has been identified in itsourcecode Leave Management System 1.0. |
medium | 6.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95868 A weakness has been identified in AdithyaYelloju Restaurant-Management-System up... |
medium | 6.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-92929 OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 trusts an X-Forward... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-92928 OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains a hardcode... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-95820 A vulnerability was found in anirbandutta9 College-Notes-Gallery up to 8c1cf3d98... |
medium | 6.3 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-95828 A vulnerability was determined in Mstfakts College-Management-System. |
medium | 4.3 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-57576 plone.app.dexterity is a content-type system for the Plone content management sy... |
medium | 6.5 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-18170 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
medium | 6.5 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-06 |
| CVE-2026-18161 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
medium | 4.3 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-06 |
| CVE-2026-18132 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
medium | 6.5 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-07 |
| CVE-2026-18133 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
medium | 6.5 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-07 |
| CVE-2026-18156 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
medium | 6.5 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-08 |
| CVE-2026-18124 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local... |
medium | 6.5 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-07 |
| CVE-2026-18131 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
medium | 6.1 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-07 |
| CVE-2026-17646 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
medium | 6.5 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-08 |
| CVE-2026-17465 IBM Concert 1.0.0 through 3.0.0 could allow a remote authenticated attacker to c... |
medium | 6.5 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2025-36084 IBM Concert 1.0.0 through 3.0.0 uses weaker than expected cryptographic algorith... |
medium | 5.9 | — | — | 2026-09-22 | 2026-10-14 |
| CVE-2026-15915 IBM Concert 1.0.0 through 3.0.0 could allow a local attacker to obtain sensitive... |
medium | 6.2 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-16426 IBM Concert 1.0.0 through 3.0.0 is vulnerable to server-side request forgery (SS... |
medium | 6.5 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2025-12767 IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to cause a denial... |
medium | 5.3 | — | — | 2026-09-22 | 2026-10-14 |
| CVE-2026-96260 Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10... |
medium | 6.5 | — | Mattermost / mattermost server | 2026-09-22 | 2026-10-07 |
| CVE-2026-95812 ClipBucket v5 before 5.5.3-#182 contains a reflected cross-site scripting vulner... |
medium | 6.1 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-95813 e621ng versions before 26.09.16 pass untrusted request parameters directly to Ra... |
medium | 6.1 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-95815 OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persi... |
medium | 6.3 | — | — | 2026-09-22 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.