September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-76958 SAP Integration Suite does not sufficiently validate XML documents accepted from... |
high | 8.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-85147 SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentia... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85540 DreamMaker developed by Interinfo has a SQL Injection vulnerability. |
high | 8.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-19858 The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2... |
high | 7.5 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-77826 The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which appl... |
high | 8.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-81404 The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape... |
high | 7.1 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-82304 The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user... |
high | 8.6 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-18480 The SureCart WordPress plugin before 4.6.3 does not ensure that the account affe... |
high | 8.8 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-84219 The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the... |
high | 7.5 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-77968 A flaw was found in hawtio-operator. |
high | 8.2 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-75021 fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignor... |
high | 8.1 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-62648 A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). |
high | 7.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-62650 A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). |
high | 8.8 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-66840 XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Una... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-81302 PALLET CONTROL products contain an incorrect default permission vulnerability, w... |
high | 7.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-14828 Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 version... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-08 |
| CVE-2026-86665 A vulnerability was identified in aircheng-org iWebShop-5 up to 5.15. |
high | 7.3 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86220 A vulnerability was detected in SourceCodester Class and Exam Timetabling System... |
high | 7.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86225 A vulnerability was identified in SourceCodester Class and Exam Timetabling Syst... |
high | 7.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86168 A security flaw has been discovered in code-projects Content Management System 1... |
high | 7.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-13297 IBM Verify Identity Access Advanced Access Control may be vulnerable to an infor... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2025-38352 Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability |
high | 7.8 | Listed | Linux / Kernel | 2025-07-22 | 2026-09-08 |
| CVE-2026-70178 Missing authorization in Microsoft Fabric allows an authorized attacker to eleva... |
high | 8.8 | — | Microsoft / fabric | 2026-09-03 | 2026-09-08 |
| CVE-2026-83959 Substance3D - Sampler is affected by a Heap-based Buffer Overflow vulnerability... |
high | 7.8 | — | Adobe / substance 3d sampler | 2026-09-03 | 2026-09-08 |
| CVE-2026-86221 A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. |
high | 7.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-16649 The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Script... |
high | 7.2 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-19769 The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPr... |
high | 7.2 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-19887 The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injectio... |
high | 8.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-16502 The Live Composer – Free WordPress Website Builder plugin for WordPress is vulne... |
high | 8.8 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-15984 The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting v... |
high | 7.2 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-14444 The WP Fusion (Pro) plugin for WordPress is vulnerable to Privilege Escalation i... |
high | 7.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-78583 Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via... |
high | 8.1 | — | Elastic / kibana | 2026-09-03 | 2026-09-08 |
| CVE-2026-85045 Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote at... |
high | 7.5 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-85048 Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a... |
high | 8.3 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-85049 Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-86306 A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d... |
high | 7.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86295 A vulnerability was found in D-Link DIR-895L A1_102b07. |
high | 8.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86300 A flaw has been found in Tenda AC9 15.03.05.14. |
high | 7.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86282 A weakness has been identified in jaychouchannel Tourism-Management-System up to... |
high | 7.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86290 A weakness has been identified in SourceCodester Online Voting System 1.0. |
high | 7.3 | — | — | 2026-09-07 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.