September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100863 Heym versions 0.0.90 and earlier contain two server-side request forgery (SSRF)... |
medium | 5.0 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100678 stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA log... |
medium | 6.5 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100694 Hugo is a static site generator. |
medium | 6.1 | — | Gohugo / hugo | 2026-09-26 | 2026-09-30 |
| CVE-2026-100698 Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the h... |
medium | 5.8 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-73192 An improper neutralization of input during web page generation ('Cross-site Scri... |
medium | 6.1 | — | Apache / sling xss protection api | 2026-09-23 | 2026-09-30 |
| CVE-2026-91852 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Apache / sling xss protection api | 2026-09-23 | 2026-09-30 |
| CVE-2026-93995 Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-93996 Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versi... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-91928 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Apache / sling xss protection api | 2026-09-23 | 2026-09-30 |
| CVE-2026-91999 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Apache / sling xss protection api | 2026-09-23 | 2026-09-30 |
| CVE-2026-18870 IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31,... |
medium | 4.3 | — | Ibm / power system s1122 \(9824-22a\) firmware | 2026-09-24 | 2026-09-30 |
| CVE-2026-92001 Improper restriction of recursive entity references in DTDs ('XML entity expansi... |
medium | 6.1 | — | Apache / sling xss protection api | 2026-09-23 | 2026-09-30 |
| CVE-2026-102313 Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 154.0.80... |
medium | 4.7 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102314 UI misrepresentation in TabStrip in Google Chrome prior to 154.0.8037.92 allowed... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102318 Out of bounds read in WebGL in Google Chrome prior to 154.0.8037.92 allowed a re... |
medium | 4.7 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-73581 Improper Check for Certificate Revocation vulnerability in Apache Tomcat. |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-102771 A security vulnerability has been detected in Naichen ThinkCMF up to 8.0.7. |
medium | 4.7 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-101087 Nezha versions 2.0.10 through 2.3.2 use a restricted HTTP client to validate use... |
medium | 4.3 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100674 stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization... |
medium | 4.3 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-95279 UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.80... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95332 Use of uninitialized variable in Tint in Google Chrome on on Android prior to 15... |
medium | 4.7 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95337 UI misrepresentation in Messages in Google Chrome on on Android prior to 154.0.8... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95321 UI misrepresentation in Payments in Google Chrome on on Android prior to 154.0.8... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102325 Uninitialized resource in Skia in Google Chrome prior to 154.0.8037.92 allowed a... |
medium | 4.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95328 Confused deputy in Mobile in Google Chrome on on Android prior to 154.0.8037.57... |
medium | 6.5 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-97292 Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2.15.0 vers... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97298 Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 v... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97299 Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment Links for... |
medium | 5.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97279 Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions. |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97282 Unauthenticated Insecure Direct Object References (IDOR) in Review Schema <= 3.1... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97285 Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions. |
medium | 5.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97288 Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions. |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97249 Unauthenticated Bypass Vulnerability in Paid Member Subscriptions <= 3.0.9 versi... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97261 Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions. |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97262 Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97266 Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97267 Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 vers... |
medium | 4.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97270 Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0 versions. |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97242 Author Arbitrary File Deletion in WEBO MCP <= 3.0.18 versions. |
medium | 6.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97243 Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions. |
medium | 5.4 | — | — | 2026-09-30 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.