September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92237 Insertion of sensitive information into log file in the slow query logging featu... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-82068 A security issue in MongoDB Server allows an authenticated user with write privi... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-69201 Http4s is a Scala interface for HTTP services. |
medium | 5.9 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-69212 Http4s is a Scala interface for HTTP services. |
medium | 5.9 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-82065 A security issue in the MongoDB Server's storage engine integration layer allows... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82063 A use-after-free security issue in the cursor management component of MongoDB Se... |
medium | 5.3 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82062 A security issue in MongoDB Server allows an authenticated user with elevated in... |
medium | 5.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82060 In MongoDB, insufficient validation of shard key values during document insertio... |
medium | 5.4 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82059 An internal aggregation expression in MongoDB Server was incorrectly registered... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82058 A flaw in MongoDB's JSON Schema validation error generation code allows an authe... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82055 A security issue exists in MongoDB's 2dsphere index key generation that can caus... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82056 A race condition in MongoDB server's text index query parsing can cause a heap u... |
medium | 5.3 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82057 A security issue was discovered in MongoDB where an authenticated user with read... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-86772 Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerabili... |
medium | 5.4 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-86768 Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpo... |
medium | 5.4 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-86767 Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET... |
medium | 5.0 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-86766 Snipe-IT versions up to and including 8.6.3 contain a race condition (TOCTOU) in... |
medium | 6.5 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-86765 Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assig... |
medium | 6.5 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-86761 snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in... |
medium | 4.3 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-86760 Snipe-IT versions 8.2.0 through 8.6.x (fixed in 8.7.0) contain an incorrect auth... |
medium | 5.4 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-86758 Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate... |
medium | 6.5 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-86757 Snipe-IT before 8.7.0 fails to properly gate access to encrypted custom-field va... |
medium | 6.5 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-16593 The WP Directory Kit WordPress plugin through 1.5.7 does not sanitize and escape... |
medium | 6.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-18232 The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or... |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-13407 The Royal Elementor Addons WordPress plugin before 1.7.1067 does not properly sa... |
medium | 5.4 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-19857 The Formidable Forms WordPress plugin before 6.35 does not prevent a request-der... |
medium | 4.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-84906 The Eventin WordPress plugin before 4.1.24 does not verify that a completed paym... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-86475 The Appointment Hour Booking WordPress plugin before 1.5.95 does not check every... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-86756 Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML... |
medium | 6.1 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-86755 Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered... |
medium | 5.4 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-86773 Snipe-IT through version 8.6.3 fails to perform object-level authorization in th... |
medium | 5.4 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-92234 QloApps through 1.7.0 reflects unescaped child feature names into back-office va... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-76858 Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulner... |
medium | 4.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-76863 Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure v... |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-76868 Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerabi... |
medium | 4.9 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-76873 Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulner... |
medium | 5.2 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-92256 NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerabi... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-45767 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
medium | 4.4 | — | Oisf / suricata | 2026-09-10 | 2026-09-16 |
| CVE-2026-92213 A vulnerability was detected in a2ui-project a2ui up to 0.10.6. |
medium | 5.5 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-92220 A vulnerability was found in vllm-project vLLM 0.26.0/0.27.0. |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.