September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,291
Critical
1,223
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-19855 The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, use... |
medium | 6.5 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-18042 The WP Travel WordPress plugin before 12.0.2 does not verify that the requester... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-17443 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.... |
medium | 6.5 | — | Ibm / app connect enterprise | 2026-09-04 | 2026-09-09 |
| CVE-2026-75165 An issue in /cgi-bin/wwwugw.cgi of MBS-Solutions X-Serie Gateway firmware V6_00_... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-78741 Silverpeas Core <=6.4.6 is vulnerable to Cross Site Scripting (XSS) in the wysiw... |
medium | 6.1 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-87732 An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. |
medium | 6.2 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-87733 An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. |
medium | 6.2 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-87737 An issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml. |
medium | 5.9 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-17469 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause... |
medium | 5.5 | — | Ibm / i | 2026-09-04 | 2026-09-09 |
| CVE-2026-86550 NuBrowser lacks protocol whitelist validation for the S.browser_fallback_url fie... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-67395 A path traversal vulnerability exists in Sage Employee Self Service’s custom log... |
medium | 5.9 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-11838 Missing authentication for critical function vulnerability in Yordam Informatics... |
medium | 4.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-19733 Server-Side request forgery (SSRF) vulnerability in Yordam Informatics Technolog... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-78377 URL redirection to untrusted site ('open redirect') vulnerability in Yordam Info... |
medium | 6.1 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-12956 The WP Event Solution (Eventin) plugin for WordPress is vulnerable to Missing Au... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-13709 The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerabl... |
medium | 6.4 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-19944 The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection... |
medium | 4.9 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-77186 The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to... |
medium | 6.4 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-7804 The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to... |
medium | 6.1 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-19945 The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 6.4 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-84908 The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in ver... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-19778 The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center &... |
medium | 6.5 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-86347 Affected versions of MISP allow any authenticated user to access TemplatesContro... |
medium | 6.5 | — | Misp-project / misp | 2026-09-07 | 2026-09-09 |
| CVE-2026-86351 Affected versions of MISP validate the user-configurable homepage by checking on... |
medium | 6.1 | — | Misp-project / misp | 2026-09-07 | 2026-09-09 |
| CVE-2026-86408 Affected versions of MISP do not enforce parent-event visibility when serving cr... |
medium | 6.5 | — | Misp-project / misp | 2026-09-07 | 2026-09-09 |
| CVE-2026-86417 Affected versions of MISP inconsistently enforced email-address visibility in Da... |
medium | 4.3 | — | Misp-project / misp | 2026-09-07 | 2026-09-09 |
| CVE-2026-86440 Affected versions of MISP insufficiently validate URLs used by dashboard widgets... |
medium | 5.4 | — | Misp-project / misp | 2026-09-07 | 2026-09-09 |
| CVE-2026-86441 Affected versions of MISP contain inconsistent authorization checks across dashb... |
medium | 4.3 | — | Misp-project / misp | 2026-09-07 | 2026-09-09 |
| CVE-2026-86451 Affected versions of MISP allow authenticated users to retrieve object-reference... |
medium | 4.3 | — | Misp-project / misp | 2026-09-07 | 2026-09-09 |
| CVE-2026-86342 Affected versions of MISP contain improper authorization checks in the freetext... |
medium | 4.3 | — | Misp-project / misp | 2026-09-07 | 2026-09-09 |
| CVE-2026-86436 Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image... |
medium | 5.4 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86308 A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99... |
medium | 5.3 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86319 A vulnerability has been found in java-json-tools json-patch up to 1.13. |
medium | 5.3 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86279 A vulnerability was determined in SourceCodester Syllabus-Aligned Learning Manag... |
medium | 6.3 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86285 A vulnerability was detected in BookStack up to 26.05.2. |
medium | 4.3 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86302 A vulnerability was found in code-projects Hospital Information System 1.0. |
medium | 5.3 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86271 A vulnerability was found in FluentCMS up to 0.0.5. |
medium | 4.7 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86215 A vulnerability was identified in Mstfakts College-Management-System. |
medium | 4.3 | — | — | 2026-09-06 | 2026-09-09 |
| CVE-2026-86234 A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. |
medium | 6.3 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-17622 IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacke... |
medium | 6.5 | — | Langflow / langflow | 2026-09-04 | 2026-09-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.