September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86277 A vulnerability has been found in SourceCodester Syllabus-Aligned Learning Manag... |
high | 7.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86214 A vulnerability was determined in Mstfakts College-Management-System. |
high | 7.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86209 A weakness has been identified in SourceCodester Class and Exam Timetabling Syst... |
high | 7.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86180 A vulnerability has been found in code-projects Task Management System In PHP 1.... |
high | 7.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-82684 Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a Mi... |
high | 8.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85051 Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a... |
high | 8.8 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-85053 Improper resource exposure in CacheStorage in Google Chrome prior to 152.0.7977.... |
high | 8.8 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-86492 In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-ten... |
high | 8.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86494 In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthori... |
high | 7.7 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86498 In JetBrains YouTrack before 2025.3.160480,
2026.1.14047 pUT requests on link s... |
high | 7.7 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-82712 Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a cr... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-77393 In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shi... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85399 A security flaw has been discovered in code-projects Hospital Information System... |
high | 7.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-77233 The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin... |
high | 7.2 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-77830 The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vu... |
high | 7.2 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-6377 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 7.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-31431 Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability |
high | 7.8 | Listed | Linux / Kernel | 2026-04-22 | 2026-09-08 |
| CVE-2026-71375 Improper restriction of XML external entity reference vulnerability in Cosminexu... |
high | 7.4 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-82302 Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configurati... |
high | 8.1 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-86298 A security flaw has been discovered in SourceCodester Class and Exam Timetabling... |
high | 7.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86272 A vulnerability was determined in Beijing Meite Software Technology U+Smart Enjo... |
high | 7.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86211 A flaw has been found in rabindralamsal inventory-management-system 1.0.0. |
high | 7.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86223 A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.... |
high | 7.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86160 A vulnerability has been found in SourceCodester Online Voting System 1.0. |
high | 7.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-77263 The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin... |
high | 7.2 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-19051 Plaintext storage of a password vulnerability in Menulux Software Inc. |
high | 7.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-19080 Observable response discrepancy vulnerability in Menulux Software Inc. |
high | 7.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-18198 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-19205 Observable response discrepancy vulnerability in GastroMenum GastroMenum Web Pan... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85649 (Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open pa... |
high | 7.9 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85094 The Canva Android App before 2.376.0 did not restrict the headers returned to an... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85012 Improper neutralization of special elements used in an OS command (CWE-78) in th... |
high | 8.0 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85028 Creation of a temporary file in a directory with insecure permissions in the FPG... |
high | 7.8 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85654 Improper neutralization of special elements used in a template engine in the CDK... |
high | 7.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85656 An OS command injection issue in the log4j-cve-2021-44228-hotpatch package in Am... |
high | 7.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85781 Unverified ownership of a storage access point in the volume deletion component... |
high | 8.7 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85786 Improper handling of highly compressed data in Amazon ion-java before 1.12.1 mig... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-81270 Apache Allura: exposure of non-public information via search. |
high | 7.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-9331 The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable... |
high | 7.1 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-85702 A security vulnerability has been detected in ramon-victor freegpt-webui up to 0... |
high | 7.3 | — | — | 2026-09-04 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.