September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-69268 Improper access control in Microsoft Office SharePoint allows an authorized atta... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-69273 Improper access control in Microsoft Office SharePoint allows an authorized atta... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-69282 Improper access control in Microsoft Office SharePoint allows an authorized atta... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-69464 Execution with unnecessary privileges in Microsoft Office SharePoint allows an a... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-69465 Missing authorization in Microsoft Office SharePoint allows an authorized attack... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-83593 The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for... |
high | 7.2 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-80099 Several Newfold plugins are vulnerable to Authentication Bypass. |
high | 8.8 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-78447 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-09 |
| CVE-2026-13359 The Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress p... |
high | 7.2 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-69683 Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an auth... |
high | 7.7 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-69716 Improper neutralization of special elements used in an sql command ('sql injecti... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-69724 Missing authorization in Microsoft Office SharePoint allows an authorized attack... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-69804 Time-of-check time-of-use (toctou) race condition in Microsoft Office SharePoint... |
high | 7.5 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-84068 The Quentn WP WordPress plugin before 1.2.15 does not adequately escape a reques... |
high | 8.6 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-62649 A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). |
high | 7.5 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-67367 A vulnerability has been identified in SIMOVE Fleetmanager V3.1 (All versions <... |
high | 8.6 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-3174 The Event Tickets and Registration plugin for WordPress is vulnerable to unautho... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-15667 The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)... |
high | 7.5 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-16960 The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public tem... |
high | 7.5 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-14962 The ELEX WooCommerce Request a Quote WordPress plugin before 2.4.1 does not prop... |
high | 8.6 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-14359 The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Priv... |
high | 8.8 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-75161 An issue in the ugw-restart method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Ser... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-75169 An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solution... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2021-44319 Parrot AR.Drone 1 and AR.Drone 2 are vulnerable to Denial of Service. |
high | 7.5 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-71626 An issue in Invoice Ninja v5.13.24 allows a remote attacker to obtain sensitive... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-75438 Buffer Overflow vulnerability in Open5GS v2.7.7 allows a remote attacker to caus... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-79423 An authenticated remote code execution (RCE) vulnerability in the admin_config.p... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-79426 An arbitrary file deletion vulnerability in the /adminapi/file/video_data_save c... |
high | 7.2 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-86145 PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of... |
high | 8.2 | — | — | 2026-09-05 | 2026-09-09 |
| CVE-2026-79376 An issue in the l2cap_handle_data() function of Bestechnic Co., Ltd BES2300 Blue... |
high | 8.8 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-79377 A heap overflow in the a2dp_decoder_sbc.cpp component of Bestechnic Co., Ltd BES... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-79378 An issue in the btm_acl_handle() function of Bestechnic Co., Ltd BES2300 Bluetoo... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-79575 The JWT signing secret in yfexam-exam v2.0 is derived from the username and the... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-78834 A code execution vulnerability exists in CMSimple 5.22 in the CoAuthors plugin. |
high | 8.8 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-85505 ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmi_oe... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-77104 CommServe contained a path traversal issue affecting information disclosure. |
high | 7.5 | — | Commvault / commvault | 2026-09-08 | 2026-09-09 |
| CVE-2026-77103 CommServe contained an authentication bypass issue affecting access authorizatio... |
high | 7.5 | — | Commvault / commvault | 2026-09-08 | 2026-09-09 |
| CVE-2026-77102 CommServe contained a heap-based buffer overflow issue affecting service availab... |
high | 7.5 | — | Commvault / commvault | 2026-09-08 | 2026-09-09 |
| CVE-2026-77101 CommServe contained a stack-based buffer overflow issue affecting service availa... |
high | 7.5 | — | Commvault / commvault | 2026-09-08 | 2026-09-09 |
| CVE-2026-17470 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of... |
high | 7.5 | — | Ibm / i | 2026-09-04 | 2026-09-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.