September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92359 A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. |
low | 3.1 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-77860 In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the '... |
low | 3.7 | — | Nlnetlabs / unbound | 2026-09-16 | 2026-09-23 |
| CVE-2026-89327 The FluentBoards WordPress plugin before 2.0.15 does not verify that a board mem... |
low | 3.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-89328 The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a... |
low | 3.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-86448 The LearnPress WordPress plugin before 4.4.7 does not perform any authentication... |
low | 3.7 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-82126 The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not... |
low | 2.7 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-84905 The Eventin WordPress plugin before 4.1.24 does not verify a user's capability t... |
low | 2.7 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-84907 The Eventin WordPress plugin before 4.1.24 does not properly authorise order fin... |
low | 3.7 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-92214 A flaw has been found in a2ui-project a2ui up to 0.10.7. |
low | 3.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-91747 Use after free in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote... |
low | 3.1 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91730 Incomplete cleanup in GetUserMedia in Google Chrome prior to 153.0.8010.47 allow... |
low | 3.1 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91723 Race condition in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed... |
low | 3.1 | — | Google / chrome | 2026-09-15 | 2026-09-18 |
| CVE-2026-91708 Race condition in Network in Google Chrome prior to 153.0.8010.47 allowed a remo... |
low | 3.1 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-87284 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
low | 3.2 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87281 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
low | 3.2 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-83369 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
low | 3.1 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-83413 Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (compo... |
low | 1.9 | — | Oracle / coherence | 2026-09-15 | 2026-09-22 |
| CVE-2026-83414 Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (compo... |
low | 2.5 | — | Oracle / coherence | 2026-09-15 | 2026-09-22 |
| CVE-2026-18425 Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action (Con... |
low | 2.7 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-21 |
| CVE-2026-81922 Concrete CMS before 9.5.3 did not enforce a per-page authorization check when re... |
low | 2.7 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-18 |
| CVE-2026-81923 In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check... |
low | 2.7 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-18 |
| CVE-2026-91957 FreeRDP before 3.31.0 contains a use-after-free vulnerability in the smartcard R... |
low | 3.1 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-88621 OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in... |
low | 2.7 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-91835 A vulnerability was detected in OpenClaw ClawScan up to 0.1.6. |
low | 2.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91836 A flaw has been found in OpenClaw ClawScan up to 0.1.6. |
low | 2.8 | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-25825 An issue was discovered in Keyfactor SignServer before 7.6.0. |
low | 2.7 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-25827 An issue was discovered in Keyfactor SignServer before 7.6.0. |
low | 2.3 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-91926 A flaw was found in gss-ntlmssp. |
low | 3.7 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2025-13166 The SMS OTP flow fails to adequately handle error messages, allowing an attacker... |
low | 3.7 | — | — | 2026-09-15 | 2026-10-14 |
| CVE-2026-91781 A security vulnerability has been detected in GNU Binutils 2.47. |
low | 3.3 | — | Gnu / binutils | 2026-09-15 | 2026-09-16 |
| CVE-2026-91782 A vulnerability was detected in GNU Binutils 2.47. |
low | 3.3 | — | Gnu / binutils | 2026-09-15 | 2026-09-17 |
| CVE-2026-91779 A security flaw has been discovered in GNU Binutils 2.47. |
low | 3.3 | — | Gnu / binutils | 2026-09-15 | 2026-09-16 |
| CVE-2026-91780 A weakness has been identified in GNU Binutils 2.47. |
low | 3.3 | — | Gnu / binutils | 2026-09-15 | 2026-09-16 |
| CVE-2026-91090 A vulnerability was determined in GPAC up to f1219cde. |
low | 3.9 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-86701 Android application "ManabiPocket for Parents" contains an improper access contr... |
low | 2.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-16592 The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization... |
low | 2.7 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-90850 A vulnerability was detected in PHPGurukul Hostel Management System 3.0. |
low | 2.4 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90845 A flaw has been found in PHPGurukul Daily Expense Tracker System 1.1. |
low | 3.5 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90842 A weakness has been identified in PHPGurukul Blood Donor Management System 1.0. |
low | 3.7 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90835 A flaw has been found in michaelliao itranswarp up to 2.19. |
low | 3.5 | — | — | 2026-09-14 | 2026-09-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.