September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-12106 The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side... |
medium | 6.4 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-81927 Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability... |
medium | 5.4 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-18 |
| CVE-2026-86902 A parsing issue in the handling of directory paths was addressed with improved p... |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-86900 An out-of-bounds read issue was addressed with improved input validation. |
medium | 6.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-86898 A logic issue was addressed with improved state management. |
medium | 5.4 | — | Apple / safari | 2026-09-14 | 2026-09-18 |
| CVE-2026-81918 Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field i... |
medium | 4.8 | — | Concretecms / concrete cms | 2026-09-11 | 2026-09-18 |
| CVE-2026-71403 A flaw was found in Rancher Manager. |
medium | 6.1 | — | Suse / rancher | 2026-09-03 | 2026-09-18 |
| CVE-2026-86886 A path traversal issue was addressed with improved input validation. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84622 A memory initialization issue was addressed with improved memory handling. |
medium | 6.2 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84616 A type confusion issue was addressed with improved memory handling. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-88005 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
medium | 6.5 | — | Openwebui / open webui | 2026-09-10 | 2026-09-18 |
| CVE-2026-88006 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
medium | 6.5 | — | Openwebui / open webui | 2026-09-10 | 2026-09-18 |
| CVE-2026-90804 A vulnerability was detected in GNU Binutils 2.47. |
medium | 6.1 | — | Gnu / binutils | 2026-09-14 | 2026-09-18 |
| CVE-2026-90801 A security flaw has been discovered in GNU Binutils 2.47. |
medium | 6.6 | — | Gnu / binutils | 2026-09-14 | 2026-09-18 |
| CVE-2026-90802 A weakness has been identified in GNU Binutils 2.47. |
medium | 4.4 | — | Gnu / binutils | 2026-09-14 | 2026-09-18 |
| CVE-2026-90803 A security vulnerability has been detected in GNU Binutils 2.47. |
medium | 6.8 | — | Gnu / binutils | 2026-09-14 | 2026-09-18 |
| CVE-2026-84571 A buffer overflow was addressed with improved bounds checking. |
medium | 4.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-43674 An authentication issue was addressed with improved state management. |
medium | 4.6 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-65376 An out-of-bounds read was addressed with improved bounds checking. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-65358 A race condition was addressed with improved state handling. |
medium | 4.7 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-65361 This issue was addressed with improved checks. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-84602 A type confusion issue was addressed with improved checks. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-28836 A correctness issue was addressed with improved checks. |
medium | 6.1 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-84439 When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated... |
medium | 5.3 | — | Apache / zookeeper | 2026-09-16 | 2026-09-18 |
| CVE-2026-84501 An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooK... |
medium | 5.3 | — | Apache / zookeeper | 2026-09-16 | 2026-09-18 |
| CVE-2026-86892 This issue was addressed with additional entitlement checks. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-75035 A flaw was found in Rancher Manager. |
medium | 6.5 | — | Suse / rancher | 2026-09-03 | 2026-09-18 |
| CVE-2026-76000 ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability tha... |
medium | 6.5 | — | Adobe / coldfusion | 2026-09-08 | 2026-09-18 |
| CVE-2026-76002 ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. |
medium | 6.1 | — | Adobe / coldfusion | 2026-09-08 | 2026-09-18 |
| CVE-2026-16750 The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-86884 A permissions issue was addressed with additional restrictions. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84615 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84600 An authorization issue was addressed with improved state management. |
medium | 5.4 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-92131 Jenkins Pipeline: Groovy Libraries Plugin 805.va_fc79344957d and earlier does no... |
medium | 4.2 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92132 Jenkins Gradle Plugin 2.19.1252.v15196b_5a_6e10 and earlier requests build scan... |
medium | 5.4 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92133 Jenkins GitLab Plugin 1.2149.vcfc32c82b_f7f and earlier caches the GitLab API cl... |
medium | 5.4 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92138 The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin... |
medium | 4.2 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92139 Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values p... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92140 Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender n... |
medium | 6.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92141 Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the r... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.