September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86555 The ZTE SmartLife application has a hardcoded key. |
medium | 6.2 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-92400 The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does... |
medium | 5.3 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-88788 The Text Styler WordPress plugin through 1.1.1 does not sanitise and escape user... |
medium | 6.8 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-17050 The experimental USB host stack allocates a per-device configuration-descriptor... |
medium | 5.7 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-17051 The Intel SEDI IPM (inter-processor mailbox) driver in drivers/ipm/ipm_sedi.c ha... |
medium | 6.0 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-17054 The Espressif ESP-hosted Wi-Fi driver (drivers/wifi/esp_hosted/) parses frames r... |
medium | 5.3 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-91203 A flaw was found in cockpit-files. |
medium | 6.0 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93999 A flaw was found in the OIDC protocol implementation of Keycloak, an open-source... |
medium | 4.2 | — | — | 2026-09-19 | 2026-09-22 |
| CVE-2026-94000 A flaw was found in the Admin REST API of Keycloak, an open-source identity and... |
medium | 6.6 | — | — | 2026-09-19 | 2026-09-22 |
| CVE-2026-94001 A flaw was found in the Admin REST API of Keycloak, an open-source identity and... |
medium | 6.5 | — | — | 2026-09-19 | 2026-09-22 |
| CVE-2026-94213 A flaw was found in the Authorization Services component of Keycloak, an open-so... |
medium | 4.9 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94215 A flaw was found in the Admin REST API of Keycloak, an open-source identity and... |
medium | 5.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-92382 An out-of-bounds write flaw was found in usbredir. |
medium | 4.1 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-76974 SAP Fiori Launchpad does not sufficiently validate certain user-controlled input... |
medium | 5.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95503 A flaw was found in the Kerberos federation provider of Keycloak, an open-source... |
medium | 6.8 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95623 The Tauri HTTP plugin validates requested URLs against the application's configu... |
medium | 5.6 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-11539 IBM WebSphere Application Server 9.0 and 8.5 is affected by an authentication by... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-11540 IBM WebSphere Application Server 9.0 and 8.5 could allow a remote attacker to ob... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-11710 IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vu... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-11711 IBM WebSphere Application Server 9.0 and 8.5 is affected by a deserialization vu... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-18869 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypa... |
medium | 6.4 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-95501 A vulnerability was found in mtrano APENCMS up to 6546096d354153309693efabb9a0d8... |
medium | 4.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95660 A security flaw has been discovered in Moonshot AI Kimi Code up to 0.31.0. |
medium | 6.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-93960 A vulnerability was identified in Pixelfed up to 0.12.11. |
medium | 4.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-93312 A flaw has been found in Freedesktop Poppler 26.07.0. |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93018 Imager versions before 1.036 for Perl disclose uninitialised heap memory reading... |
medium | 5.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-85709 LightRAG provides simple and fast retrieval-augmented generation. |
medium | 5.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-86062 LightRAG provides simple and fast retrieval-augmented generation. |
medium | 6.1 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-81894 Concrete CMS 9.5.2 and below is vulnerable to stored DOM-based Cross-site Script... |
medium | 5.4 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-22 |
| CVE-2026-81896 Concrete CMS before 9.5.3 does not apply HTML entity encoding to user-defined Fo... |
medium | 5.4 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-22 |
| CVE-2026-81897 In Concrete CMS below CMS 9.5.3, the save_control action in the Express entities... |
medium | 5.4 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-22 |
| CVE-2026-73638 Imager versions from 0.45_02 before 1.035 for Perl read outside the EXIF block v... |
medium | 6.2 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-69674 Missing authentication for critical function in Windows Modern Device Management... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-22 |
| CVE-2026-82163 Dell Command | Intel vPro Out of Band, versions prior to 4.7.2, contain an Incor... |
medium | 5.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-82165 Dell Command | Integration Suite for System Center, versions prior to 6.7.2, con... |
medium | 5.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94570 SGLang contains a DoS vulnerability caused by missing input validation for AUX_D... |
medium | 5.9 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-83077 Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM... |
medium | 6.4 | — | Oracle / siebel crm | 2026-09-15 | 2026-09-22 |
| CVE-2026-74765 Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read vi... |
medium | 6.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-83441 Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (comp... |
medium | 6.8 | — | Oracle / product hub | 2026-09-15 | 2026-09-22 |
| CVE-2026-83491 Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (com... |
medium | 6.8 | — | Oracle / irecruitment | 2026-09-15 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.