September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-28630 In onCreate of ContactsPickerActivity.kt, there is a possible misleading UI due... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28582 In onCreate of ConfirmDeviceCredentialActivity.java, there is a possible unautho... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-0054 In isCallerAllowed of WalletContextualLocationsService.kt, there is a possible w... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-9216 An insufficient input validation vulnerability in the listed NETGEAR RAX series... |
low | 3.5 | — | Netgear / rax30 firmware | 2026-09-08 | 2026-10-13 |
| CVE-2026-86670 A flaw has been found in aircheng-org iWebShop-5 up to 5.15. |
low | 3.7 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-69904 Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an auth... |
low | 3.5 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-48707 InstantCMS is a free and open source content management system. |
low | 3.1 | — | — | 2026-09-08 | 2026-09-11 |
| CVE-2026-84389 A url redirection to untrusted site ('open redirect') vulnerability in Fortinet... |
low | 3.1 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-84392 A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet For... |
low | 2.7 | — | — | 2026-09-08 | 2026-10-29 |
| CVE-2026-86644 A vulnerability was determined in star7th showdoc up to 3.9.1. |
low | 3.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-73317 XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP... |
low | 2.7 | — | Xenforo / xenforo | 2026-09-08 | 2026-09-11 |
| CVE-2026-73318 XenForo before 2.3.13 contains a missing authorization vulnerability in the forc... |
low | 3.8 | — | Xenforo / xenforo | 2026-09-08 | 2026-09-14 |
| CVE-2026-33920 A cross-site request forgery vulnerability was discovered in the login functiona... |
low | 3.5 | — | — | 2026-09-08 | 2026-10-15 |
| CVE-2026-76960 SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cr... |
low | 3.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-76961 SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cr... |
low | 3.5 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-58234 SAP Process Integration (SOAP Adapter) allows a privileged user to send speciall... |
low | 2.2 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86505 In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked pr... |
low | 3.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86501 In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be writt... |
low | 2.8 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86503 In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could tr... |
low | 3.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86491 In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project an... |
low | 3.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86485 In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed f... |
low | 3.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86486 In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed... |
low | 3.7 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86487 In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed re... |
low | 3.1 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86422 ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability i... |
low | 3.3 | — | Imagemagick / imagemagick | 2026-09-07 | 2026-10-29 |
| CVE-2026-86424 ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (... |
low | 2.5 | — | Imagemagick / imagemagick | 2026-09-07 | 2026-10-29 |
| CVE-2026-86301 A vulnerability has been found in code-projects Hospital Information System 1.0. |
low | 3.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2025-52652 HCL MyXalytics was affected by Content Spoofing Vulnerability. |
low | 3.5 | — | — | 2026-09-07 | 2026-10-19 |
| CVE-2025-52657 HCL MyXalytics was affected by Potential DOS Vulnerability. |
low | 3.5 | — | — | 2026-09-07 | 2026-10-19 |
| CVE-2025-52651 HCL MyXalytics was affected by Improper Input validation Vulnerability. |
low | 3.5 | — | — | 2026-09-07 | 2026-10-19 |
| CVE-2026-86231 A security flaw has been discovered in mwiede jsch up to 2.28.5. |
low | 3.7 | — | — | 2026-09-06 | 2026-09-11 |
| CVE-2026-86227 A weakness has been identified in valkey-io valkey up to 9.0.5/9.1.1. |
low | 3.1 | — | — | 2026-09-06 | 2026-09-09 |
| CVE-2026-86226 A security flaw has been discovered in Projectwolds Online Attendance System 1.0... |
low | 3.5 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2021-48006 PocketMine-MP before 4.0.3 does not perform case-insensitive matching when remov... |
low | 3.3 | — | — | 2026-09-06 | 2026-10-08 |
| CVE-2026-86181 A vulnerability was found in code-projects Task Management System 1.0. |
low | 3.5 | — | — | 2026-09-06 | 2026-09-09 |
| CVE-2025-15614 ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW dec... |
low | 3.3 | — | — | 2026-09-05 | 2026-10-19 |
| CVE-2026-84926 The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access... |
low | 2.7 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84927 The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient autho... |
low | 2.7 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84225 The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to... |
low | 2.2 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84745 The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-publi... |
low | 2.7 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-78150 The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership... |
low | 2.7 | — | — | 2026-09-05 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.