September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-90498 A vulnerability was identified in lenve vhr 1.0-SNAPSHOT. |
high | 7.3 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90514 A vulnerability has been found in SourceCodester School Registration and Fee Sys... |
high | 7.3 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-88939 knowns through 0.33.0 exempts the project.set action from permission guard check... |
high | 8.3 | — | — | 2026-09-10 | 2026-09-15 |
| CVE-2026-88866 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a s... |
high | 8.7 | — | — | 2026-09-10 | 2026-09-15 |
| CVE-2026-88876 AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a miss... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-15 |
| CVE-2026-88011 Traefik is an open source HTTP reverse proxy and load balancer. |
high | 8.1 | — | Traefik / traefik | 2026-09-10 | 2026-09-15 |
| CVE-2026-88016 rclone is a command-line program to sync files and directories to and from diffe... |
high | 7.1 | — | Rclone / rclone | 2026-09-10 | 2026-09-15 |
| CVE-2026-73698 FileRun before 2026.3.0 contains a SQL injection vulnerability that allows deleg... |
high | 7.2 | — | — | 2026-09-10 | 2026-09-15 |
| CVE-2026-78175 The Tutor LMS – eLearning and online course solution plugin for WordPress is vul... |
high | 8.8 | — | — | 2026-09-12 | 2026-09-15 |
| CVE-2026-75983 The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugi... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-16482 The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulner... |
high | 7.5 | — | — | 2026-09-12 | 2026-09-15 |
| CVE-2026-18486 IBM ContextForge MCP Gateway <= v1.0.7 MCP Context Forge could allow a remote au... |
high | 8.8 | — | Ibm / contextforge | 2026-09-04 | 2026-09-15 |
| CVE-2026-18489 IBM ContextForge MCP Gateway - Translate utility <= 1.0.8 MCP Context Forge coul... |
high | 7.4 | — | Ibm / contextforge | 2026-09-04 | 2026-09-15 |
| CVE-2026-78456 Heap-based buffer overflow in SQL Server allows an authorized attacker to execut... |
high | 8.8 | — | Microsoft / sql server 2022 | 2026-09-08 | 2026-09-15 |
| CVE-2026-77481 Heap-based buffer overflow in SQL Server allows an authorized attacker to execut... |
high | 8.8 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-57126 PraisonAI is a multi-agent teams system. |
high | 8.5 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-57130 PraisonAI is a multi-agent teams system. |
high | 8.1 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-57122 PraisonAI is a multi-agent teams system. |
high | 8.6 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-57134 PraisonAI is a multi-agent teams system. |
high | 8.2 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-57135 PraisonAI is a multi-agent teams system. |
high | 7.6 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-57136 PraisonAI is a multi-agent teams system. |
high | 8.8 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-57137 PraisonAI is a multi-agent teams system. |
high | 8.8 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-84933 undici's cache interceptor does not handle the Set-Cookie response header anywhe... |
high | 8.2 | — | Nodejs / undici | 2026-09-04 | 2026-09-15 |
| CVE-2026-90840 A vulnerability was identified in PHPGurukul Blood Donor Management System 1.0. |
high | 7.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90844 A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. |
high | 7.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90849 A security vulnerability has been detected in SourceCodester College Notes Galle... |
high | 7.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90855 A weakness has been identified in SourceCodester/katojkalemba Online Food Orderi... |
high | 7.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90856 A security vulnerability has been detected in SourceCodester College Notes Galle... |
high | 7.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90877 A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. |
high | 7.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-91087 A flaw has been found in GPAC up to f1219cde. |
high | 7.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-28590 In multiple locations, there is a possible improper encryption key validation du... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28583 In validate_camera_metadata_structure of camera_metadata.c, there is a possible... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28572 In onCreate of InstallLaunch.kt, there is a possible misleading UI due to a tapj... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-0084 In multiple functions of HostEmulationManager.java, there is a possible backgrou... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-0065 In areBackgroundActivityStartsAllowed of BackgroundLaunchProcessController.java,... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28607 In multiple functions in multiple locations, there is a possible background acti... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28604 In multiple locations, there is a possible use after free due to a race conditio... |
high | 7.5 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28603 In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a p... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28602 In setClipboardAccessNotificationsEnabledForUser of ClipboardService.java, there... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28600 In onCreate of PaymentDefaultDialog.java, there is a possible way to change defa... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.