September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,291
Critical
1,223
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-90492 A security vulnerability has been detected in webgjc web_robot 2.4.0/2.5.0/2.8.0... |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90500 A weakness has been identified in lenve vhr 1.0-SNAPSHOT. |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90505 A vulnerability was found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b... |
medium | 5.0 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90507 A vulnerability was identified in vvbbnn00 WARP-Clash-API up to c7bf236007395986... |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90513 A flaw has been found in simalexan api-lambda-send-email-ses up to bda6869aa8137... |
medium | 6.5 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90518 A security flaw has been discovered in PHPGurukul Bank Locker Management System... |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90521 A vulnerability was found in jaychouchannel Tourism-Management-System up to 8122... |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90571 A vulnerability was found in Exrick xmall up to 19e7917d5ed3bd2a2421a3a246ad494c... |
medium | 4.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90574 A security flaw has been discovered in itsourcecode Sales and Inventory System 1... |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90581 A vulnerability was determined in cym1102 nginxWebUI up to 4.4.2. |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90584 A weakness has been identified in TooTallNate Java-WebSocket up to 1.6.1. |
medium | 5.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90594 A vulnerability was identified in wxiaoqi Spring-Cloud-Platform 3.0.1/3.1.0. |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90597 A security vulnerability has been detected in itsourcecode Sales and Inventory S... |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90599 A flaw has been found in Rizwan17 inventory-management-system up to 5e74a46b4b70... |
medium | 4.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90614 A weakness has been identified in FedML-AI FedML up to 0.9.6. |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90686 A vulnerability was found in GPAC up to f1219cde. |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90704 A vulnerability was found in D-Link DWR-M921 1.1.52. |
medium | 6.6 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90706 A vulnerability was identified in D-Link DWR-M921 1.1.52. |
medium | 6.6 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90709 A security vulnerability has been detected in Yot CMS up to 3.3.1. |
medium | 4.7 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90712 A vulnerability was identified in Gitlawb openclaude up to 0.30.0. |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90784 A vulnerability has been found in Dvidelabs flatcc up to 0.6.3. |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90792 A flaw has been found in GPAC up to f1219cde. |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90794 A vulnerability was found in GPAC up to f1219cde. |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90806 A vulnerability has been found in DjangoCRM django-crm up to 1.2. |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90808 A vulnerability was determined in HKUDS nanobot up to 0.2.1. |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90813 A vulnerability was detected in cosmicstack-labs mercury-agent up to 1.1.13. |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-86742 Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted a... |
medium | 6.5 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-14 |
| CVE-2026-86743 Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report qu... |
medium | 5.0 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-14 |
| CVE-2026-86745 Snipe-IT is an IT asset management application. |
medium | 6.5 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-14 |
| CVE-2026-86746 Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire... |
medium | 6.4 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-14 |
| CVE-2026-86747 Snipe-IT is an open source IT asset management system. |
medium | 5.4 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-14 |
| CVE-2026-86748 Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded... |
medium | 6.1 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-14 |
| CVE-2026-86752 snipe-it versions before 8.7.0 fail to enforce per-instance FMCS scoping in asse... |
medium | 5.4 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-14 |
| CVE-2026-86753 snipe-it versions before 8.7.0 fail to validate the requestable flag for asset m... |
medium | 4.3 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-14 |
| CVE-2026-86714 PX4 Autopilot through 1.17.0 contains a stack buffer over-read vulnerability in... |
medium | 5.4 | — | — | 2026-09-08 | 2026-09-14 |
| CVE-2026-85583 SiYuan versions before v3.8.2 contain a path traversal vulnerability in the read... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-14 |
| CVE-2026-85598 Grav versions 2.0.0 through 2.0.17 fail to apply save-time XSS detection to modu... |
medium | 6.4 | — | — | 2026-09-04 | 2026-09-14 |
| CVE-2026-85603 Grav versions before 1.10.55 contain a path traversal vulnerability in the admin... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-14 |
| CVE-2026-80115 PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 10... |
medium | 6.1 | — | — | 2026-09-04 | 2026-09-14 |
| CVE-2026-77161 The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable... |
medium | 6.5 | — | — | 2026-09-12 | 2026-09-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.