September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-2310 IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable... |
high | 7.8 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-19991 The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in ver... |
high | 8.1 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-15406 The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)... |
high | 7.5 | — | — | 2026-09-09 | 2026-09-11 |
| CVE-2026-18561 The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL I... |
high | 7.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-18579 The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site... |
high | 7.2 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-62106 Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.9 versio... |
high | 8.8 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-62112 Editor SQL Injection in Amelia <= 2.4.9 versions. |
high | 7.6 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-84650 In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot b... |
high | 8.8 | — | Jenkins / jenkins | 2026-09-02 | 2026-09-11 |
| CVE-2026-84645 In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked a... |
high | 8.8 | — | Jenkins / jenkins | 2026-09-02 | 2026-09-11 |
| CVE-2026-84648 In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer doe... |
high | 8.8 | — | Jenkins / jenkins | 2026-09-02 | 2026-09-11 |
| CVE-2026-70334 Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorize... |
high | 7.8 | — | Microsoft / visual studio code | 2026-09-08 | 2026-09-11 |
| CVE-2026-78461 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
high | 7.4 | — | Microsoft / visual studio code | 2026-09-08 | 2026-09-11 |
| CVE-2026-78462 Authorization bypass through user-controlled key in Visual Studio Code allows an... |
high | 8.8 | — | Microsoft / visual studio code | 2026-09-08 | 2026-09-11 |
| CVE-2026-81356 Inconsistent interpretation of http requests ('http request/response smuggling')... |
high | 8.2 | — | Microsoft / visual studio code | 2026-09-08 | 2026-09-11 |
| CVE-2026-81357 Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized... |
high | 8.2 | — | Microsoft / visual studio code | 2026-09-08 | 2026-09-11 |
| CVE-2026-84652 In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate t... |
high | 7.3 | — | Jenkins / jenkins | 2026-09-02 | 2026-09-11 |
| CVE-2026-81378 Interpretation conflict in Visual Studio Code allows an unauthorized attacker to... |
high | 8.2 | — | Microsoft / visual studio code | 2026-09-08 | 2026-09-11 |
| CVE-2026-81379 Not failing securely ('failing open') in Visual Studio Code allows an unauthoriz... |
high | 8.2 | — | Microsoft / visual studio code | 2026-09-08 | 2026-09-11 |
| CVE-2026-73316 XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST... |
high | 7.5 | — | Xenforo / xenforo | 2026-09-08 | 2026-09-11 |
| CVE-2026-73315 XenForo before 2.3.13 contains a server-side request forgery vulnerability in th... |
high | 8.6 | — | Xenforo / xenforo | 2026-09-08 | 2026-09-11 |
| CVE-2026-73314 XenForo before 2.3.13 contains a signature verification logic error in the PayPa... |
high | 7.5 | — | Xenforo / xenforo | 2026-09-08 | 2026-09-11 |
| CVE-2026-73312 XenForo before 2.3.13 contains a refresh token replay vulnerability that allows... |
high | 7.4 | — | Xenforo / xenforo | 2026-09-08 | 2026-09-11 |
| CVE-2026-73311 XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability... |
high | 7.4 | — | Xenforo / xenforo | 2026-09-08 | 2026-09-11 |
| CVE-2026-74239 XenForo before 2.3.13 contains a path traversal vulnerability in the style archi... |
high | 7.2 | — | Xenforo / xenforo | 2026-09-08 | 2026-09-11 |
| CVE-2026-89256 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored... |
high | 8.7 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-88895 CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoi... |
high | 7.2 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-72992 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-77489 Null pointer dereference in Windows Biometric Service allows an authorized attac... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-77906 Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to e... |
high | 8.8 | — | Microsoft / visual studio 2026 | 2026-09-08 | 2026-09-11 |
| CVE-2026-69727 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-70572 Integer overflow or wraparound in Windows Biometric Service allows an authorized... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-72994 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-72997 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-73000 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-73015 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-73020 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-82006 Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that... |
high | 7.8 | — | Adobe / photoshop | 2026-09-08 | 2026-09-11 |
| CVE-2026-82007 Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability... |
high | 7.8 | — | Adobe / photoshop | 2026-09-08 | 2026-09-11 |
| CVE-2026-89262 MoguBlog through 6.2 contains an authorization bypass vulnerability in the comme... |
high | 7.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-73694 FileRun before 2026.3.0 contains an OS command injection vulnerability caused by... |
high | 7.2 | — | — | 2026-09-10 | 2026-09-11 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.