September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,291
Critical
1,223
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-75135 UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerabil... |
medium | 6.1 | — | — | 2026-09-02 | 2026-09-08 |
| CVE-2026-75136 UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulne... |
medium | 6.1 | — | — | 2026-09-02 | 2026-09-08 |
| CVE-2026-75137 UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerabil... |
medium | 6.1 | — | — | 2026-09-02 | 2026-09-08 |
| CVE-2026-85156 WWBN AVideo fails to properly validate access controls on the public channel pag... |
medium | 5.3 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85157 WWBN AVideo contains a broken access control vulnerability in the unauthenticate... |
medium | 5.3 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85158 AVideo through commit c91b5975d contains a reflected cross-site scripting vulner... |
medium | 5.4 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85159 AVideo through commit c91b5975d contains a reflected cross-site scripting vulner... |
medium | 5.4 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85161 AVideo through commit c91b5975d contains a cross-site request forgery vulnerabil... |
medium | 4.3 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85162 AVideo through commit c91b5975d contains a cross-site request forgery vulnerabil... |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85163 AVideo through commit c91b5975d contains a server-side request forgery vulnerabi... |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-82023 LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authoriz... |
medium | 4.3 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-82024 LearnPress WordPress Plugin before 4.4.6 contains a stored cross-site scripting... |
medium | 5.4 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85611 OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization... |
medium | 6.4 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-74235 GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability... |
medium | 4.9 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-74236 GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85577 AVideo through commit c91b5975d contains a reflected cross-site scripting vulner... |
medium | 5.4 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85579 SiYuan is affected by an information disclosure vulnerability (confirmed in v3.8... |
medium | 4.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85580 SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the M... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85582 SiYuan versions before v3.8.2 contain an unbounded session creation vulnerabilit... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85600 Grav Admin (getgrav/grav-plugin-admin2) versions <= 2.0.19 contain a stored cros... |
medium | 5.4 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85602 The Grav Form plugin (getgrav/grav-plugin-form) versions 8.0.6 through 9.1.19 se... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-86100 Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when... |
medium | 6.4 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86111 BookWyrm through 0.9.1 fails to validate user visibility permissions in the stat... |
medium | 6.5 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86113 BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edi... |
medium | 6.5 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86186 AVideo API fails to enforce rate limits when clients send a bot User-Agent heade... |
medium | 6.5 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86191 SiYuan versions before v3.8.2 contain an information disclosure vulnerability in... |
medium | 4.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2022-51008 PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing at... |
medium | 5.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86175 NetBox through 4.7.0 fails to redact sensitive data source backend credentials i... |
medium | 6.5 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86205 h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the red... |
medium | 5.4 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86252 h3 versions before 1.15.9 fail to sanitize carriage return characters in EventSt... |
medium | 5.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86254 wger versions through master contain an incomplete authorization bypass in wger/... |
medium | 6.8 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86257 wger before 2.6 fails to sanitize first_name and last_name fields in the gym mem... |
medium | 5.4 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-18073 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to injec... |
medium | 4.4 | — | Ibm / i | 2026-09-04 | 2026-09-08 |
| CVE-2026-18078 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to caus... |
medium | 6.5 | — | Ibm / i | 2026-09-04 | 2026-09-08 |
| CVE-2026-75163 An information disclosure vulnerability in the ugw-deviceinfo method of /cgi-bin... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-75164 An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solution... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-75168 An issue in the ugw-editfile method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Se... |
medium | 6.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-78970 JeecgBoot 3.9.2 and earlier contains an authorization bypass vulnerability in th... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-19032 jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supp... |
medium | 5.3 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83557 DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automat... |
medium | 5.6 | — | — | 2026-09-01 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.