September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92789 Graylog through 7.1.4 validates outbound URLs against an allowlist before making... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92800 Docs before 5.4.1 fails to properly revoke websocket collaboration connections w... |
medium | 6.8 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92802 kan through 0.6.0 fails to properly validate board creation permissions in the G... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92803 LibreTranslate through 1.9.6 omits the access_check decorator from the download_... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92811 browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restric... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92814 changedetection.io through 0.60.6 fails to escape the scraped page title in HTML... |
medium | 4.2 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92920 admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user... |
medium | 5.4 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92921 admin3 through 3.0.0 stores account passwords using single-round MD5 with only t... |
medium | 4.9 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-93454 Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and rend... |
medium | 5.4 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93455 django-page-cms through 2.0.13 fails to properly validate page permissions in ad... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-77927 ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability tha... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-77928 ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability tha... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93736 Mealie before 3.21.0 fails to validate user ownership in the ratings and favorit... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93869 Cotonti through 1.0.0 contains an open redirect vulnerability in the cot_url_che... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93870 Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin A... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93871 Cotonti through 1.0.0 fails to validate redirect destinations in page bodies pre... |
medium | 5.4 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93873 Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the contact plugin s... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-94533 lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in File... |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-93341 MarketKing plugin for WordPress before 2.1.72 contains a missing authorization v... |
medium | 4.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-93344 MarketKing plugin for WordPress before 2.1.72 contains a missing authorization v... |
medium | 6.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-73759 Vulnerabilities in AOS-CX could allow an unauthenticated remote malicious actor... |
medium | 6.5 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-22 |
| CVE-2026-92809 PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92810 PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in t... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-89034 TCH QRing smart ring model R20_B006 running firmware RT09R20_1.00.00_250318 cont... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92579 In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded allow... |
medium | 5.4 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92581 In AVideo through 29.0, Like::__construct() performs counter arithmetic on raw r... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92583 AVideo through 29.0 contains a race condition in the enforceRateLimit() function... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92584 AVideo through 29.0 (current revision e01e41ecc) contains a stored cross-site sc... |
medium | 6.1 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92585 AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to v... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92586 AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to v... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92912 AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 uses cryptographically w... |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-93660 SQLBot through 1.10.1 fails to verify dashboard ownership in update_resource and... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-81943 PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions bef... |
medium | 6.7 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-81946 PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions bef... |
medium | 4.4 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93838 SGLang versions through 0.5.20 contain an unbounded memory allocation vulnerabil... |
medium | 5.9 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-94105 NivoCart through 2.4.0 contains a destructive configuration write vulnerability... |
medium | 5.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-94111 Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerabili... |
medium | 6.6 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-94413 jshERP through 3.6 fails to redact password hashes in the /user/info endpoint, a... |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94414 jshERP through 3.6 is missing an authorization check on the POST /userBusiness/u... |
medium | 5.4 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94494 jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows... |
medium | 5.0 | — | — | 2026-09-21 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.