September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-80116 PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 10... |
high | 7.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-80117 PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 10... |
high | 7.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-80119 PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 10... |
high | 7.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85452 MOOS ui-moos through 50b9c6c contains a buffer overflow vulnerability in ScopeTa... |
high | 8.8 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85584 SiYuan versions before v3.8.2 contain a denial of service vulnerability in the p... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85585 SiYuan before v3.8.2 contains an unbounded resource consumption vulnerability in... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85599 Grav Shortcode Core before 6.2.5 contains stored cross-site scripting vulnerabil... |
high | 7.2 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85604 Grav before 2.0.18 (affected versions <= 2.0.17) contains a remote code executio... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-86188 AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerabili... |
high | 7.2 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86437 Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/up... |
high | 7.2 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86439 knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool argu... |
high | 8.8 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86540 knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary... |
high | 7.8 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86711 electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated... |
high | 7.4 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86713 PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in the load... |
high | 7.1 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86718 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a c... |
high | 7.1 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86720 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to val... |
high | 8.1 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86723 AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains an authenticati... |
high | 8.1 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86725 AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing autho... |
high | 7.1 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86728 AVideo through 29.0 contains an authentication bypass vulnerability in plugin/Pl... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86730 Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-la... |
high | 8.8 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-51974 An eval() injection vulnerability in the get_list function in modules/meta_parse... |
high | 8.8 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2021-44320 Parrot AR.Drone version 1 and 2 does not employ a suitable mechanism to prevent... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2022-35499 In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to r... |
high | 7.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-18341 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to corr... |
high | 8.8 | — | Ibm / i | 2026-09-04 | 2026-09-08 |
| CVE-2026-18672 In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation... |
high | 7.5 | — | — | 2026-09-02 | 2026-09-08 |
| CVE-2026-19219 In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity p... |
high | 8.1 | — | — | 2026-09-02 | 2026-09-08 |
| CVE-2026-0799 In BPF instructions that load/store a value from/to a scratch memory register th... |
high | 8.7 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86673 A vulnerability was determined in ningzichun Student Management System up to 987... |
high | 7.3 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86669 A vulnerability was detected in aircheng-org iWebShop-5 up to 5.15. |
high | 7.3 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86287 Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths. |
high | 7.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86159 A flaw has been found in SourceCodester Online Voting System 1.0. |
high | 7.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86162 A vulnerability was determined in SourceCodester Online Voting System 1.0. |
high | 7.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-52691 ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-47625 NVIDIA Triton Inference Server for Linux contains a vulnerability where an attac... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-16497 NVIDIA Triton Inference Server for Linux contains a vulnerability where an attac... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-16028 Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed... |
high | 7.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-16281 The Classified Listing WordPress plugin before 6.1.1 does not verify that the ca... |
high | 7.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-19224 The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a n... |
high | 7.2 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-84934 The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability che... |
high | 8.0 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84935 The HT Menu WordPress plugin before 1.2.7 does not perform any capability or obj... |
high | 8.0 | — | — | 2026-09-05 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.