September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-93342 MarketKing plugin for WordPress before 2.1.72 contains a missing authorization v... |
medium | 5.4 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-78441 Out-of-bounds read in Windows OLE DB allows an unauthorized attacker to disclose... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-23 |
| CVE-2026-83097 Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component... |
medium | 6.5 | — | Oracle / forms | 2026-09-15 | 2026-09-23 |
| CVE-2026-83109 Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component... |
medium | 5.3 | — | Oracle / forms | 2026-09-15 | 2026-09-23 |
| CVE-2026-95897 A security vulnerability has been detected in Dask up to 2026.8.0. |
medium | 5.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95930 A security vulnerability has been detected in iFlytek astron-agent up to 1.0.6. |
medium | 6.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95957 A vulnerability was found in SourceCodester Smart Attendance System with QR Code... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95830 A security flaw has been discovered in theRealSain Pixtream up to 866afd4f0cea81... |
medium | 6.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95833 A weakness has been identified in itsourcecode Leave Management System 1.0. |
medium | 6.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-6831 The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing aut... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-53682 An unauthenticated client can query the Security Domain hosts inventory via GET... |
medium | 5.3 | — | — | 2026-09-01 | 2026-09-23 |
| CVE-2026-5924 The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross... |
medium | 6.4 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95828 A vulnerability was determined in Mstfakts College-Management-System. |
medium | 4.3 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-95928 A security flaw has been discovered in recommenders-team recommenders up to 1.2.... |
medium | 5.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-87285 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
medium | 6.0 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87267 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
medium | 5.3 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87274 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
medium | 4.4 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87275 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
medium | 4.6 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87278 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
medium | 6.1 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87279 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
medium | 6.1 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87280 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
medium | 4.2 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87282 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
medium | 6.0 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87283 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
medium | 6.0 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-86516 A vulnerability was detected in elenavanengelenmaslova mocknest-serverless 0.9.0... |
medium | 4.7 | — | — | 2026-09-08 | 2026-09-23 |
| CVE-2026-92455 yshop-crm through 2.1.3 fails to enforce authorization on the sendSms and sendMa... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92457 yshop-crm through 2.1.3 contains a missing authorization vulnerability in the Cr... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92458 yshop-crm through 2.1.3 contains a missing authorization vulnerability in the St... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92460 yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92461 yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GE... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92360 A weakness has been identified in ag-ui-protocol ag-ui 1.0. |
medium | 6.3 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-84835 Missing Authorization vulnerability in DimaFreund Rentsyst rentsyst allows Explo... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-23 |
| CVE-2026-84217 Missing Authorization vulnerability in Mamunur Rashid Classified Listing classif... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-23 |
| CVE-2026-12683 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 5.4 | — | — | 2026-09-10 | 2026-09-23 |
| CVE-2026-12682 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 5.4 | — | — | 2026-09-10 | 2026-09-23 |
| CVE-2026-86805 A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld... |
medium | 6.3 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-17262 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to cause a denial of s... |
medium | 5.4 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-92526 A flaw has been found in itsourcecode Leave Management System 1.0. |
medium | 6.3 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-65393 A permissions issue was addressed with improved validation. |
medium | 5.5 | — | Apple / xcode | 2026-09-14 | 2026-09-22 |
| CVE-2026-20235 A vulnerability in the API of Cisco Identity Services Engine (ISE) could allow a... |
medium | 4.9 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-20282 A vulnerability in Cisco ISE could allow an authenticated, remote attacker to ob... |
medium | 4.9 | — | — | 2026-09-16 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.