September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-94492 A security vulnerability has been detected in Yonyou U8cloud 5.x. |
medium | 6.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-85653 The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-... |
medium | 6.4 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-93655 The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site... |
medium | 6.1 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-12995 The Custom Field Template plugin for WordPress is vulnerable to Insecure Direct... |
medium | 4.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-16778 The Live Composer – Free WordPress Website Builder plugin for WordPress is vulne... |
medium | 6.4 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-18345 The WP User Manager plugin for WordPress is vulnerable to unauthorized modificat... |
medium | 4.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-1645 The Hostel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via... |
medium | 4.4 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-4123 The RW Elephant Rental Inventory plugin for WordPress is vulnerable to Missing A... |
medium | 4.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-7622 The ThumbPress plugin for WordPress is vulnerable to unauthorized access in vers... |
medium | 4.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-9004 The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerab... |
medium | 4.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-15095 The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & So... |
medium | 4.9 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95273 A vulnerability was determined in dgtlmoon changedetection.io up to 0.60.7. |
medium | 4.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-79913 Cloudreve is a self-hosted file management and sharing system. |
medium | 6.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-56682 9Router is an AI router & token saver. |
medium | 5.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-69741 Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to dis... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-22 |
| CVE-2026-77122 An authorization flaw in the REST API repository details endpoint (GET /service/... |
medium | 4.3 | — | Sonatype / nexus repository manager | 2026-09-02 | 2026-09-22 |
| CVE-2026-77123 Nexus Repository 3 contains a sensitive information disclosure vulnerability in... |
medium | 6.5 | — | Sonatype / nexus repository manager | 2026-09-02 | 2026-09-22 |
| CVE-2026-93957 A vulnerability has been found in olivier-ls PHP-FTS up to 1.1.3. |
medium | 4.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-93967 A vulnerability was found in aiyiyi121 SxDevOps 1.0/1.1. |
medium | 5.5 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-91147 A flaw was found in `cockpit-ws`. |
medium | 5.9 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-76796 The LoadImageAsPngBase64 endpoint of the Newell Brands DYMO Connect Desktop loca... |
medium | 4.0 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-71224 A stack overflow vulnerability was found in gfs2-utils. |
medium | 4.7 | — | Redhat / enterprise linux | 2026-09-03 | 2026-09-22 |
| CVE-2026-71222 A heap out-of-bounds read vulnerability was found in gfs2-utils. |
medium | 6.3 | — | Redhat / enterprise linux | 2026-09-03 | 2026-09-22 |
| CVE-2026-71219 A stack overflow vulnerability was found in gfs2-utils. |
medium | 4.7 | — | Redhat / enterprise linux | 2026-09-03 | 2026-09-22 |
| CVE-2026-84963 An incorrect numeric conversion in the JSON parsing component of the MongoDB C D... |
medium | 5.3 | — | Mongodb / c driver | 2026-09-03 | 2026-09-22 |
| CVE-2026-94094 A flaw has been found in OpenClaw up to 2026.9.5. |
medium | 4.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-94152 A security vulnerability has been detected in Omega Solution FBP Fulfillment by... |
medium | 4.3 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94032 A flaw has been found in itsourcecode Leave Management System 1.0. |
medium | 6.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-94037 A weakness has been identified in 00Kisumi00 mcp-file-analyzer up to 84740852f0c... |
medium | 4.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-94042 A vulnerability was found in AdithyaYelloju Restaurant Management System up to 7... |
medium | 6.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-94047 A security vulnerability has been detected in samanhappy MCPHub up to 1.0.32. |
medium | 6.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-93954 A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-22 |
| CVE-2026-93964 A vulnerability was detected in NginxProxyManager nginx-proxy-manager up to 2.15... |
medium | 5.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-93311 A vulnerability was detected in Freedesktop Poppler 26.07.0. |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93532 A security vulnerability has been detected in gedelumbung HospitalManagement up... |
medium | 6.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-92475 A weakness has been identified in GPAC 26.08-DEV. |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92880 A weakness has been identified in vgmstream up to r2117. |
medium | 6.3 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92993 A vulnerability was detected in Dromara mayfly-go up to 1.11.5. |
medium | 6.3 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92365 A vulnerability was found in vllm-project vllm up to 0.29.0. |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92402 A security flaw has been discovered in ChangeWeDer crm up to c07bd4c97141521af64... |
medium | 6.3 | — | — | 2026-09-16 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.