September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84603 A permissions issue was addressed with additional restrictions. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-17 |
| CVE-2026-69294 Generation of error message containing sensitive information in Microsoft COM fo... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-17 |
| CVE-2026-69315 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-17 |
| CVE-2026-69339 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-17 |
| CVE-2026-69374 Allocation of resources without limits or throttling in Windows SMB Server allow... |
medium | 6.5 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-17 |
| CVE-2026-69390 Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to dis... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-17 |
| CVE-2026-92945 vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllo... |
medium | 4.2 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-91936 Flowise versions before 3.1.4 contain a script injection vulnerability in Docker... |
medium | 6.8 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-91942 crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-84522 A race condition was addressed with improved state management. |
medium | 5.9 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-84556 An authorization issue was addressed with improved access control. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-43791 A validation issue was addressed with improved input sanitization. |
medium | 6.5 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-69507 Insertion of sensitive information into externally-accessible file or directory... |
medium | 5.7 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-17 |
| CVE-2026-69267 Insufficient granularity of access control in Windows Connected User Experiences... |
medium | 6.5 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-17 |
| CVE-2026-84559 A permissions issue was addressed with improved validation. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-91005 A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. |
medium | 6.3 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-90881 A weakness has been identified in D-Link DIR-882 up to 20260814. |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-15758 The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plug... |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-84962 An unauthorized user with key vault write access may cause an authorized client... |
medium | 4.2 | — | Mongodb / libmongocrypt | 2026-09-03 | 2026-09-17 |
| CVE-2026-84971 Improper handling of an unexpected value size in the decryption path of a client... |
medium | 6.5 | — | Mongodb / libmongocrypt | 2026-09-03 | 2026-09-17 |
| CVE-2026-91717 Missing authorization in Android in Google Chrome on on Android prior to 153.0.8... |
medium | 5.1 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91714 Observable discrepancy in Fonts in Google Chrome prior to 153.0.8010.47 allowed... |
medium | 5.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91713 Missing authorization in Browser in Google Chrome prior to 153.0.8010.47 allowed... |
medium | 4.2 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-87907 The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any a... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-87959 The WPBot WordPress plugin before 8.7.6 does not perform a capability check on t... |
medium | 5.4 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-88910 The kboard WordPress plugin before 6.7 does not verify ownership or context befo... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-87828 The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a c... |
medium | 5.7 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-87854 The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correct... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-87860 The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-87896 The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any a... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-86823 The Newsletter WordPress plugin before 9.3.7 does not validate the destination o... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-86784 The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a char... |
medium | 6.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-86447 The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilit... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-86449 The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilit... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-85572 The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has acces... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-85641 The Formidable Forms WordPress plugin before 6.35 does not restrict who can set... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-86445 The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilit... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-85131 The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or c... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-85349 The FluentBoards WordPress plugin before 2.0.15 does not properly verify authori... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-84088 The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does... |
medium | 6.8 | — | — | 2026-09-16 | 2026-09-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.