September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-57115 PraisonAI is a multi-agent teams system. |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90820 A security vulnerability has been detected in a2aproject a2a-java 1.2.0. |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-85575 The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solu... |
medium | 6.4 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90851 A flaw has been found in PHPGurukul Hostel Management System 3.0. |
medium | 6.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90857 A vulnerability was detected in SourceCodester College Notes Gallery Management... |
medium | 6.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90878 A vulnerability was determined in vllm-project vLLM up to 0.27.1. |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-91002 A weakness has been identified in stamparm maltrail up to 3.0.1. |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-89141 The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPre... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-28584 In createSessionInternal of PackageInstallerService.java, there is a possible wa... |
medium | 5.5 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-84947 undici's dump interceptor reads and discards a response body up to a configurabl... |
medium | 5.3 | — | Nodejs / undici | 2026-09-04 | 2026-09-15 |
| CVE-2026-28596 In parseInterventionFromXml of GameManagerService.java, there is a possible perm... |
medium | 5.5 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28617 In add of WifiNetworkSuggestionsManager.java, there is a possible persistent DOS... |
medium | 5.5 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-85008 undici's cache interceptor documents that only safe HTTP methods are cached, but... |
medium | 5.3 | — | Nodejs / undici | 2026-09-04 | 2026-09-15 |
| CVE-2026-90814 A flaw has been found in cosmicstack-labs mercury-agent up to 1.1.13. |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90795 A vulnerability was determined in itsourcecode Loan Management System 1.0. |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90790 A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90785 A vulnerability was found in Dvidelabs flatcc up to 0.6.3. |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90697 A vulnerability was identified in SourceCodester Inventory Management System 1.0... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90687 A vulnerability was determined in GPAC up to f1219cde. |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90682 A security vulnerability has been detected in Matthias-Wandel jhead up to 3.3. |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90621 A vulnerability was identified in ipa-lab HackingBuddyGPT up to 0.5.0. |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90615 A security vulnerability has been detected in SourceCodester Class and Exam Time... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90600 A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90595 A security flaw has been discovered in wxiaoqi Spring-Cloud-Platform 1.0/2.2/3.0... |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-28627 In btm_sec_encrypt_change of btm_sec.cc, there is a possible downgrade attack du... |
medium | 4.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28633 In initForUserNoTracing of VoiceInteractionManagerService.java, there is a possi... |
medium | 5.5 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-73476 Improper Handling of Case Sensitivity vulnerability in Drupal External Authentic... |
medium | 5.4 | — | External Authentication Project / external authentication | 2026-09-02 | 2026-09-15 |
| CVE-2026-87627 Interpretation conflict in Safebrowsing in Google Chrome on on Mac prior to 153.... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-14 |
| CVE-2026-15892 The mcumgr SMP settings-management group handlers settings_mgmt_read(), settings... |
medium | 5.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-15923 The Zephyr SDIO subsystem function sdio_io_rw_extended_helper() in subsys/sd/sdi... |
medium | 4.6 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-15893 net_if_ipv6_calc_reachable_time() in subsys/net/ip/net_if.c derives a randomized... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-15924 Zephyr's TLS socket layer in subsys/net/lib/sockets/sockets_tls.c keeps a single... |
medium | 5.9 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-16147 The ITE IT82xx2 USB device-controller driver (drivers/usb/udc/udc_it82xx2.c) mis... |
medium | 6.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-16148 The ITE it82xx2 USB device-controller driver initialized its bus-suspend detecti... |
medium | 4.6 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-77689 The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 d... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-77753 The Temporary Login Without Password WordPress plugin before 1.9.9 does not prev... |
medium | 5.5 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-78152 The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' register... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-82847 The Masteriyo LMS WordPress plugin before 3.4.1 does not sanitise and escape one... |
medium | 6.8 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-83532 The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize a... |
medium | 6.8 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-84023 The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce or check use... |
medium | 6.5 | — | — | 2026-09-12 | 2026-09-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.