September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-82124 The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-82125 The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-77702 The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-78474 The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not have any... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-76553 The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a pat... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-76555 The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a use... |
medium | 6.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-76556 The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanit... |
medium | 6.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-76557 The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanit... |
medium | 6.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-76558 The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom... |
medium | 6.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-76559 The WP Import Export Lite WordPress plugin before 3.9.33 does not properly valid... |
medium | 4.1 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-73465 On affected platforms running Arista EOS, under certain circumstances plaintext... |
medium | 6.3 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-73466 On affected platforms running Arista EOS, under certain circumstances user passw... |
medium | 6.3 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-14276 IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could... |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-17 |
| CVE-2026-14277 IBM i Access Family 1.1.2.0 through 1.1.9.15 could allow an authenticated user t... |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-17 |
| CVE-2026-14275 IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could... |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-17 |
| CVE-2026-68886 Use after free in Windows Network Connection Broker allows an authorized attacke... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-17 |
| CVE-2026-68873 Insertion of sensitive information into log file in Windows Program Compatibilit... |
medium | 5.5 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-17 |
| CVE-2026-43690 A race condition was addressed with improved locking. |
medium | 4.7 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-43719 A use-after-free issue was addressed with improved memory management. |
medium | 6.5 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-69820 Heap-based buffer overflow in Windows Hello allows an authorized attacker to ele... |
medium | 6.7 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-16 |
| CVE-2026-81049 Dell ThinOS 10, versions prior to 2605_10.2616, contain a Missing Support for In... |
medium | 6.7 | — | Dell / thinos | 2026-09-10 | 2026-09-16 |
| CVE-2026-81051 Dell ThinOS 10, versions prior to 2605_10.2616, contain a Security Version Numbe... |
medium | 6.6 | — | Dell / thinos | 2026-09-10 | 2026-09-16 |
| CVE-2026-81052 Dell ThinOS 10, versions prior to 2605_10.2616, contain a Download of Code Witho... |
medium | 6.8 | — | Dell / thinos | 2026-09-10 | 2026-09-16 |
| CVE-2026-81900 Concrete CMS before 9.5.3 applied only trim() to the YouTube block's stored widt... |
medium | 6.1 | — | Concretecms / concrete cms | 2026-09-14 | 2026-09-16 |
| CVE-2026-85024 undici bundles a WebSocket client whose permessage-deflate size-limit cleanup re... |
medium | 5.9 | — | Nodejs / undici | 2026-09-04 | 2026-09-16 |
| CVE-2026-68849 Out-of-bounds read in Windows Bluetooth Port Driver allows an authorized attacke... |
medium | 4.7 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-16 |
| CVE-2026-18149 undici's retry handler can leave an already-exposed response body pending foreve... |
medium | 5.9 | — | Nodejs / undici | 2026-09-04 | 2026-09-16 |
| CVE-2026-80176 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 4.7 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-16 |
| CVE-2026-82052 The $regexFindAll expression can be used by an authenticated user who can run ag... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82054 A security issue exists in MongoDB server's JSON Pointer parser used during $jso... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82074 MongoDB Server contains an incorrect authorization vulnerability in the aggregat... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82073 A security issue in the MongoDB Server aggregation framework allows an authentic... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-69211 Http4s is a Scala interface for HTTP services. |
medium | 4.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-69214 Http4s is a Scala interface for HTTP services. |
medium | 6.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-69216 Http4s is a Scala interface for HTTP services. |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-69206 Http4s is a Scala interface for HTTP services. |
medium | 5.9 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-69215 Http4s is a Scala interface for HTTP services. |
medium | 6.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-82070 A security issue in MongoDB Server's diagnostic reporting interface allows an au... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82069 A security issue in MongoDB Server's query statistics serialization on the route... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-89321 Publishing limits the compressed size of a VSIX (ovsx.publishing.max-content-siz... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.