September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-77105 CommServe contained a cryptographic signature verification issue affecting privi... |
high | 8.8 | — | Commvault / commvault | 2026-09-08 | 2026-09-09 |
| CVE-2026-14296 When using the Direct XIP
update strategy, the main application image starts oth... |
high | 7.5 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-14957 In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKe... |
high | 7.5 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-18058 The mobile Smart Connect dashboard UI was subject to manipulation
by 3rd party a... |
high | 7.5 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-86242 Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path... |
high | 8.1 | — | — | 2026-09-06 | 2026-09-09 |
| CVE-2026-19651 IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3... |
high | 7.4 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-17499 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary c... |
high | 7.8 | — | Ibm / i | 2026-09-04 | 2026-09-09 |
| CVE-2026-86806 A weakness has been identified in opengeos GeoLibre up to 2.3.0. |
high | 7.3 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-76801 The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart A... |
high | 8.8 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-17553 The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in ve... |
high | 7.2 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-84293 The Repeater Fields for Gravity Forms plugin for WordPress is vulnerable to Stor... |
high | 7.2 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-76009 The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable... |
high | 8.1 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-14989 The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is... |
high | 7.2 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-86539 knowns through 0.33.0 contains a server-side request forgery vulnerability in th... |
high | 7.2 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86544 knowns versions before 0.30.0 contain an authorization bypass vulnerability wher... |
high | 8.1 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86292 A vulnerability was detected in SourceCodester Simple Traffic Offense System 1.0... |
high | 7.3 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86297 A vulnerability was identified in D-Link DIR-605 B1v202WWB03. |
high | 8.1 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86276 A flaw has been found in SourceCodester Syllabus-Aligned Learning Management & E... |
high | 7.3 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86222 A vulnerability has been found in SourceCodester Class and Exam Timetabling Syst... |
high | 7.3 | — | — | 2026-09-06 | 2026-09-09 |
| CVE-2026-6431 The User Profile Builder – Beautiful User Registration Forms, User Profiles & Us... |
high | 7.2 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-17627 IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacke... |
high | 7.1 | — | Langflow / langflow | 2026-09-04 | 2026-09-09 |
| CVE-2026-78543 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.... |
high | 7.5 | — | Ibm / app connect enterprise | 2026-09-04 | 2026-09-09 |
| CVE-2026-86210 A security vulnerability has been detected in SourceCodester Class and Exam Time... |
high | 7.3 | — | — | 2026-09-06 | 2026-09-09 |
| CVE-2026-18851 Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0... |
high | 8.8 | — | Ivanti / endpoint manager mobile | 2026-09-08 | 2026-09-09 |
| CVE-2026-86733 Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive dire... |
high | 7.2 | — | Snipeitapp / snipe-it | 2026-09-08 | 2026-09-09 |
| CVE-2026-76196 Photoshop Mobile is affected by a Session Fixation vulnerability that could resu... |
high | 7.4 | — | Adobe / photoshop mobile | 2026-09-08 | 2026-09-09 |
| CVE-2026-77109 Adobe Commerce is affected by an Incorrect Authorization vulnerability that coul... |
high | 8.6 | — | Adobe / commerce | 2026-09-08 | 2026-09-09 |
| CVE-2026-77774 Adobe Commerce is affected by an Incorrect Authorization vulnerability that coul... |
high | 8.6 | — | Adobe / commerce | 2026-09-08 | 2026-09-09 |
| CVE-2026-83961 ColdFusion is affected by an Improper Authentication vulnerability that could re... |
high | 7.1 | — | Adobe / coldfusion | 2026-09-03 | 2026-09-09 |
| CVE-2026-78254 The ftp and scp tasks of Apache Ant can download files from a remote server. |
high | 7.4 | — | Apache / ant | 2026-09-07 | 2026-09-09 |
| CVE-2026-86738 Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Cust... |
high | 8.7 | — | Snipeitapp / snipe-it | 2026-09-08 | 2026-09-09 |
| CVE-2026-86502 In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the... |
high | 8.4 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86504 In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation be... |
high | 7.8 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86479 In JetBrains YouTrack before 2026.2.18788,
2026.1.14055,
2025.3.161254 missing... |
high | 8.1 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-83527 An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10... |
high | 8.1 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-81963 Microsoft Windows Link Following Vulnerability |
high | 7.8 | Listed | Microsoft / Windows | 2026-09-08 | 2026-09-09 |
| CVE-2026-76967 SAP NetWeaver Business Client does not perform sufficient validation when proces... |
high | 7.8 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-66767 SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenti... |
high | 7.7 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-45200 Software installed and run as a non-privileged user may conduct improper GPU dri... |
high | 7.8 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-19633 PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked u... |
high | 8.8 | — | — | 2026-09-06 | 2026-09-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.