September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,291
Critical
1,223
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-89248 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is missing an aut... |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89258 Hugo is a static site generator. |
medium | 6.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-81824 The vulnerability, if exploited, could allow a miscreant to run arbitrary JavaSc... |
medium | 4.7 | — | — | 2026-09-08 | 2026-09-11 |
| CVE-2026-19985 The Relevanssi – A Better Search plugin for WordPress is vulnerable to Reflected... |
medium | 6.1 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-87584 Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-87580 Incorrect authorization in WebAppInstalls in Google Chrome prior to 153.0.8010.3... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-87589 Incorrect authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-85239 A vulnerability in MISP's event template handling allowed an authenticated user... |
medium | 6.5 | — | Misp-project / misp | 2026-09-03 | 2026-09-11 |
| CVE-2026-7438 The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site S... |
medium | 6.4 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-75639 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-75659 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-75668 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-75674 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-75709 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-75733 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-75738 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-72627 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-6641 The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-S... |
medium | 6.4 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-6640 The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-S... |
medium | 6.4 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-19612 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-12215 The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authe... |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-18964 The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeC... |
medium | 6.1 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-85238 MISP contains a session fixation vulnerability in the CustomAuth authentication... |
medium | 6.8 | — | Misp-project / misp | 2026-09-03 | 2026-09-11 |
| CVE-2026-87590 Improper input validation in Passwords in Google Chrome prior to 153.0.8010.36 a... |
medium | 5.9 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-87591 Incorrect authorization in Extensions in Google Chrome prior to 153.0.8010.36 al... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-19479 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-87603 Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allo... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-87610 Incorrect authorization in Omnibox in Google Chrome prior to 153.0.8010.36 allow... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-87626 Incorrect authorization in DeviceBoundSessionCredentials in Google Chrome prior... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-87600 Improper input validation in Safebrowsing in Google Chrome on on Android prior t... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-75646 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-71357 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-75667 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-75657 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-79741 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 5.3 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-11 |
| CVE-2026-79945 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 5.5 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-11 |
| CVE-2026-21101 Improper input validation in DualDAR driver prior to SMR Sep-2026 Release 1 allo... |
medium | 6.7 | — | Samsung / android | 2026-09-09 | 2026-09-11 |
| CVE-2026-75644 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-75637 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
| CVE-2026-72626 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-09-08 | 2026-09-11 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.