September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-5399 The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 6.4 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-15889 The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site... |
medium | 6.4 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88280 GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser password into a fix... |
medium | 4.9 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88281 GeoVision GV-LPC2211 V1.13 fails to limit repeated Username elements in ONVIF De... |
medium | 4.9 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88283 GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF Create... |
medium | 4.9 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88284 GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF SetUse... |
medium | 4.9 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88288 GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownload... |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88279 GeoVision GV-LPC2211 V1.13 copies oversized ONVIF CreateUsers username or passwo... |
medium | 4.9 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88264 A flaw was found in crun. |
medium | 5.6 | — | — | 2026-09-10 | 2026-09-25 |
| CVE-2026-88265 A flaw was found in crun. |
medium | 5.6 | — | — | 2026-09-10 | 2026-10-02 |
| CVE-2026-88268 GeoVision GV-LPC2211
V1.13 contains an authenticated stack buffer overflow in SS... |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88269 GeoVision GV-LPC2211 V1.13 allows a Guest user to retrieve persistent device con... |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88270 GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mo... |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-42806 An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI... |
medium | 4.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-42808 An issue was discovered in Bosch Sensortec COINES_SDK versions 2.0 through 2.11. |
medium | 6.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88763 A flaw was found in the skupper-router component of Red Hat Service Interconnect... |
medium | 5.9 | — | — | 2026-09-10 | 2026-10-13 |
| CVE-2026-88770 A flaw was found in the Device Authorization Grant flow of Keycloak, an identity... |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-81635 A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an att... |
medium | 5.4 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-82582 An authorization bypass vulnerability exists in SHIRASAGI through a user-control... |
medium | 4.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-19840 The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on se... |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-85645 The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugi... |
medium | 6.1 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-57822 When the broker is processing message-based management requests, sent by an auth... |
medium | 6.5 | — | Apache / artemis | 2026-09-10 | 2026-09-16 |
| CVE-2026-75880 An authenticated client could attach a consumer with a selector containing craft... |
medium | 6.5 | — | Apache / artemis | 2026-09-10 | 2026-09-18 |
| CVE-2026-4657 The Easy Google Fonts plugin for WordPress is vulnerable to Stored Cross-Site Sc... |
medium | 6.4 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-15820 The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-... |
medium | 6.4 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-15823 The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized... |
medium | 4.3 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-18386 The WP BackItUp Community Edition plugin for WordPress is vulnerable to Director... |
medium | 4.9 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-18594 The Advanced Contact form 7 DB plugin for WordPress is vulnerable to authorizati... |
medium | 4.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-15796 The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-... |
medium | 6.4 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-84062 BurgerEditor 3.0.0 through 3.4.0 contains an issue with authorization bypass thr... |
medium | 4.3 | — | — | 2026-09-10 | 2026-10-01 |
| CVE-2026-84063 BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of f... |
medium | 6.5 | — | — | 2026-09-10 | 2026-10-01 |
| CVE-2026-87870 The Ninja Forms - Scheduled Exports plugin for WordPress is vulnerable to Stored... |
medium | 6.4 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-87926 A flaw has been found in Rizwan17 inventory-management-system up to bfe78a330d01... |
medium | 4.3 | — | — | 2026-09-10 | 2026-09-14 |
| CVE-2026-87923 A weakness has been identified in Rizwan17 inventory-management-system up to bfe... |
medium | 4.3 | — | — | 2026-09-09 | 2026-09-11 |
| CVE-2026-87924 A security vulnerability has been detected in Rizwan17 inventory-management-syst... |
medium | 6.5 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-15460 The Bluetooth Classic (BR/EDR) L2CAP receive handler bt_l2cap_br_recv() in subsy... |
medium | 5.4 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-88002 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
medium | 6.5 | — | Openwebui / open webui | 2026-09-09 | 2026-09-14 |
| CVE-2026-87997 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
medium | 4.3 | — | Openwebui / open webui | 2026-09-09 | 2026-09-16 |
| CVE-2026-88000 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
medium | 6.5 | — | Openwebui / open webui | 2026-09-09 | 2026-09-14 |
| CVE-2026-88001 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
medium | 5.0 | — | Openwebui / open webui | 2026-09-09 | 2026-09-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.