September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-90536 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to aut... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-21 |
| CVE-2026-90546 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to val... |
medium | 4.3 | — | — | 2026-09-12 | 2026-09-21 |
| CVE-2026-90551 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to val... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-21 |
| CVE-2026-90499 A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. |
medium | 5.4 | — | — | 2026-09-13 | 2026-09-21 |
| CVE-2026-90494 A flaw has been found in restify node-restify up to 12.0.0. |
medium | 5.3 | — | — | 2026-09-13 | 2026-09-21 |
| CVE-2026-56889 In multiple locations, there is a possible permission bypass due to an integer o... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-83250 Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83251 Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-56892 In ReadDataElement of common.c, there is a possible information disclosure due t... |
medium | 6.2 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-83175 Vulnerability in the Oracle Application Object Library product of Oracle E-Busin... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83198 Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (co... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-56907 In VPU, there is a possible shared memory overwrite due to improper input valida... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56964 In multiple locations, there is a possible use-after-free due to a race conditio... |
medium | 6.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56958 In gf_algo_get_cached_dump_data of gf_algo.c, there is a possible out-of-bounds... |
medium | 5.5 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56950 In validate_ns_buf of mbu_class.rs, there is a possible information disclosure d... |
medium | 4.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56932 In Trusted Execution Environment, there is a possible memory corruption due to i... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56923 In handle_unmap_req of tipc_virtio_dev.c, there is a possible memory corruption... |
medium | 6.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56922 In CPM, there is a possible permission bypass due to a confused deputy. |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56915 In bigo_worker_thread of bigo.c, there is a possible escalation of privilege due... |
medium | 6.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-94138 A security flaw has been discovered in Chengdu Feiyuxing Technology Feiyu Star R... |
medium | 6.6 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94151 A weakness has been identified in Omega Solution HRM OS up to 20260717. |
medium | 5.3 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94103 A vulnerability has been found in RooCMS up to 1.2.2/1.3.4/1.4RC2. |
medium | 4.7 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-83416 Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (compo... |
medium | 4.3 | — | Oracle / coherence | 2026-09-15 | 2026-09-21 |
| CVE-2026-94028 A weakness has been identified in mealie-recipes Mealie up to 3.25.1. |
medium | 4.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-93961 A security flaw has been discovered in Dromara UJCMS up to 12.3.1. |
medium | 5.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-93966 A vulnerability has been found in aiyiyi121 SxDevOps 1.0/1.1. |
medium | 4.7 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-93971 A weakness has been identified in aiyiyi121 SxDevOps 1.0/1.1. |
medium | 5.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-93921 SiYuan versions through 3.8.4 fail to enforce publish access control in the getD... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-85010 The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplie... |
medium | 5.3 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-85113 The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters f... |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-69393 Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to dis... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-21 |
| CVE-2026-91742 Confused deputy in PriceTracking in Google Chrome on on iOS prior to 153.0.8010.... |
medium | 4.8 | — | Google / chrome | 2026-09-15 | 2026-09-21 |
| CVE-2026-69403 Missing authorization in Windows SMB Server allows an authorized attacker to dis... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-21 |
| CVE-2026-82561 Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entir... |
medium | 6.5 | — | Apache / nifi | 2026-09-16 | 2026-09-21 |
| CVE-2026-81866 Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and veri... |
medium | 4.3 | — | Apache / nifi | 2026-09-16 | 2026-09-21 |
| CVE-2026-16557 The Nimble Page Builder WordPress plugin through 3.3.8 does not perform an autho... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-19860 The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3... |
medium | 5.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-84750 The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not vali... |
medium | 6.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-91847 The Online Scheduling and Appointment Booking System WordPress plugin before 28.... |
medium | 4.8 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-92099 The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authori... |
medium | 6.5 | — | — | 2026-09-19 | 2026-09-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.