September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-47132 phpMyFAQ is an open source FAQ web application. |
medium | 5.4 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-69531 Unintended proxy or intermediary ('confused deputy') in Microsoft Windows Speech... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-97179 A security vulnerability has been detected in O2OA up to 9.5.3/10.0.2. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96772 A security flaw has been discovered in Intelliants Subrion CMS up to 4.2.1. |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-84716 A flaw was found in the automation-controller instance
install-bundle endpoint. |
medium | 6.6 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-18335 The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordP... |
medium | 5.4 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-4806 The Custom Thank You Page for WooCommerce plugin for WordPress is vulnerable to... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-93763 A protection mechanism failure in the object-document mapper's encryption config... |
medium | 6.5 | — | Mongodb / mongoid | 2026-09-18 | 2026-09-24 |
| CVE-2026-93764 Mongoid may omit encryption rules for fields declared on embedded models when ge... |
medium | 6.5 | — | Mongodb / mongoid | 2026-09-18 | 2026-09-24 |
| CVE-2026-11538 IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vuln... |
medium | 5.3 | — | Ibm / websphere application server | 2026-09-18 | 2026-09-24 |
| CVE-2026-55256 In parsePartHeaders of multiple files, there is a possible persistent denial of... |
medium | 6.5 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-92756 Applications built on MongoDB Entity Framework Core Provider which combine indep... |
medium | 5.5 | — | Mongodb / entity framework core provider | 2026-09-17 | 2026-09-24 |
| CVE-2026-92758 If logging mode is set to DEBUG or a malformed MongoDB connection string is used... |
medium | 5.5 | — | Mongodb / entity framework core provider | 2026-09-17 | 2026-09-24 |
| CVE-2026-92757 Applications built on MongoDB Entity Framework Core Provider which place a datab... |
medium | 5.5 | — | Mongodb / entity framework core provider | 2026-09-17 | 2026-09-24 |
| CVE-2026-45527 In convertCleanApertureToRect of HeifCleanAperture.cpp, there is a possible way... |
medium | 4.3 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-96551 A vulnerability was determined in sfturing hosp_order up to 627f426331da8086ce8f... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96764 A weakness has been identified in kvcache-ai mooncake up to 0.3.12/0.3.14-rc1. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-86867 Cinnamon's Kotaemon (all versions up to and including v0.12.0) multi-user chat i... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-84718 A flaw was found in the Ansible Automation Platform automation-controller. |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-84720 A flaw was found in the Ansible Automation Platform automation-controller. |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-81645 Out-of-bounds read vulnerability in the graphics module. |
medium | 5.9 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-3253 The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to u... |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96445 A flaw was found in the Conditional OTP authenticator of Keycloak, an identity a... |
medium | 6.8 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96545 An out-of-bounds heap read flaw was found in GIMP's TIM image loader. |
medium | 4.4 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-92905 ZohoCorp ManageEngine EventLog Analyzer and Log360 before build 13071 were vulne... |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97181 GPM LIGHT developed by ezGlobal has a Sensitive Data Exposure vulnerability. |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-84091 The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-74991 The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment... |
medium | 6.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-80338 The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on... |
medium | 6.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-82195 The 10Web Booster WordPress plugin before 2.34.0 does not restrict access to the... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-82849 The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user ma... |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-82850 The Masteriyo LMS WordPress plugin before 3.4.2 does not restrict access to quiz... |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-88845 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not per... |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-88846 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not che... |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-88847 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not ver... |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-89002 The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitize... |
medium | 6.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-89005 The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise... |
medium | 6.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-93662 The Events Manager WordPress plugin before 7.4.5 does not force the scope of its... |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96773 A weakness has been identified in Intelliants Subrion CMS up to 4.2.1. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96774 A vulnerability was found in SPON Communications IP Network Audio Device XC-9603... |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.