September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,291
Critical
1,223
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-18238 The rpcap client code that processes a RPCAP_MSG_PACKET message received from th... |
medium | 5.0 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-18313 rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPC... |
medium | 4.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-31911 libpcap BPF interpreter calls abort() if it encounters a BPF instruction that ha... |
medium | 5.5 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-31912 libpcap BPF interpreter detects neither reaching the end of the filter program b... |
medium | 5.5 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-6244 libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not... |
medium | 5.5 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-79603 x86 PV guests can free memory pages while still keeping a stale TLB entry
pointi... |
medium | 4.3 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86237 A vulnerability was found in openagents-org openagents up to 0.8.19/0.9.3.post20... |
medium | 5.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86164 A security flaw has been discovered in itsourcecode Sales and Inventory System 1... |
medium | 6.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-85229 ** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of input during web page... |
medium | 6.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-82309 Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outb... |
medium | 4.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-17517 The Content Views WordPress plugin before 4.5.1.2 does not check whether the use... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-74853 The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a dis... |
medium | 6.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-79630 The WPFunnels WordPress plugin before 3.13.0 does not verify that the product re... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-79631 The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-79632 The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-80438 The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilit... |
medium | 5.9 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-81347 The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not proper... |
medium | 5.9 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-82186 The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate... |
medium | 4.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-82193 The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does n... |
medium | 5.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-82194 The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does n... |
medium | 5.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-84146 The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-84044 The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not ve... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-84045 The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 doe... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-84930 The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84931 The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or es... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84936 The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization... |
medium | 5.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84937 The Video Player for YouTube WordPress plugin before 2.1.0 does not properly san... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-85038 The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices,... |
medium | 5.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-44766 SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged a... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-76959 SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cr... |
medium | 4.6 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-76962 SAP S/4HANA (Manage Bank Chains app) does not perform sufficient authorization c... |
medium | 4.3 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-76963 Due to a missing authorization check in Application Server ABAP of SAP NetWeaver... |
medium | 4.3 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-76968 SAP Web Dispatcher, Internet Communication Manager and SAP Content Server allows... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-76971 Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP Manufacturing I... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-76977 SAP UI5 does not sufficiently validate the parent frame's origin against the con... |
medium | 4.3 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-85084 Out-of-bounds Write and Improper Validation of Array Index vulnerability in Sams... |
medium | 6.3 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-49509 Out-of-bounds read vulnerability in Samsung Opensource rLottie allows Overread B... |
medium | 4.4 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85149 SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentia... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-84043 The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does no... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85541 DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerabi... |
medium | 5.4 | — | — | 2026-09-04 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.