September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,293
Critical
1,225
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-20514 In Audio HAL, there is a possible information disclosure due to a missing permis... |
medium | 4.4 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-77698 Zohocorp ManageEngine Endpoint Central versions before 11.5.2605.01 are vulnerab... |
medium | 5.7 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-77697 Zohocorp ManageEngine Endpoint Central versions below 11.4.2540.23 are vulnerabl... |
medium | 6.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-77699 Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 are vulnerabl... |
medium | 5.0 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-85640 Zohocorp ManageEngine Endpoint Central versions below 11.5.2600.15 are vulnerabl... |
medium | 6.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-22575 An improper access control vulnerability in Fortinet FortiManager 7.6.0 through... |
medium | 4.9 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-84391 A use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 th... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86667 A weakness has been identified in aircheng-org iWebShop-5 up to 5.15. |
medium | 4.7 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-78602 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (... |
medium | 5.3 | — | Elastic / maps server | 2026-09-02 | 2026-09-08 |
| CVE-2026-86179 A flaw has been found in code-projects Daily Expense Manager 1.0. |
medium | 5.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86232 A weakness has been identified in itsourcecode Sales and Inventory System 1.0. |
medium | 6.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86163 A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. |
medium | 6.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-85701 A vulnerability has been found in ramon-victor freegpt-webui up to 098db3dfeb415... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85636 A vulnerability was identified in jofpin trape 1.0.0. |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85643 A flaw has been found in code-projects Online Shopping System 1.0. |
medium | 4.7 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-16689 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.... |
medium | 5.5 | — | Ibm / app connect enterprise | 2026-09-04 | 2026-09-08 |
| CVE-2026-84327 Incorrect authorization in Autofill in Google Chrome on on Android prior to 152.... |
medium | 6.5 | — | Google / chrome | 2026-09-02 | 2026-09-08 |
| CVE-2026-84330 UI misrepresentation in FullScreen in Google Chrome on on Android prior to 152.0... |
medium | 5.4 | — | Google / chrome | 2026-09-02 | 2026-09-08 |
| CVE-2026-16693 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obta... |
medium | 4.9 | — | Ibm / i | 2026-09-04 | 2026-09-08 |
| CVE-2026-16892 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypa... |
medium | 5.4 | — | Ibm / i | 2026-09-04 | 2026-09-08 |
| CVE-2026-86274 A security vulnerability has been detected in projeto-siga siga up to 11.0.2.10/... |
medium | 5.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-85513 A weakness has been identified in StackStorm st2 up to 3.9.0. |
medium | 6.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-18021 The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for W... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-12853 The Flamingo plugin for WordPress is vulnerable to authorization bypass in all v... |
medium | 5.4 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-17259 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to caus... |
medium | 6.5 | — | Ibm / i | 2026-09-04 | 2026-09-08 |
| CVE-2026-85044 Use of released resource in Mobile in Google Chrome on on Android prior to 152.0... |
medium | 6.5 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-86233 A security vulnerability has been detected in itsourcecode Sales and Inventory S... |
medium | 6.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-85787 An incomplete list of disallowed inputs in the SQL validation component in Amazo... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-86506 In JetBrains GoLand before 2026.2.2.1 missing authentication on the GoLand profi... |
medium | 5.9 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86481 In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of... |
medium | 4.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86483 In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile... |
medium | 5.4 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86484 In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assign... |
medium | 4.6 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86488 In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListC... |
medium | 6.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86489 In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclo... |
medium | 6.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86490 In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed ove... |
medium | 6.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86493 In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed rea... |
medium | 6.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86495 In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed crea... |
medium | 6.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86496 In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk aut... |
medium | 4.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86497 In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-aut... |
medium | 6.8 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86499 In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all gr... |
medium | 4.3 | — | — | 2026-09-07 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.