September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,293
Critical
1,225
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86500 In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user... |
medium | 5.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-0001 Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valha... |
medium | 4.4 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-8279 The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deleti... |
medium | 5.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86317 A vulnerability was detected in ggml-org llama.cpp up to 0.4.0. |
medium | 5.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86270 A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. |
medium | 6.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86275 A vulnerability was detected in SourceCodester Syllabus-Aligned Learning Managem... |
medium | 5.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86278 A vulnerability was found in SourceCodester Syllabus-Aligned Learning Management... |
medium | 4.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86284 A security vulnerability has been detected in jaychouchannel Tourism-Management-... |
medium | 5.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86291 A security vulnerability has been detected in itsourcecode Sales and Inventory S... |
medium | 6.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86238 A vulnerability was determined in projectworlds Online Examination System 1.0. |
medium | 4.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-85381 A security vulnerability has been detected in light0011 cms c774dce31c6df0055568... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-76931 The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Si... |
medium | 6.4 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-71216 PagerDuty alarm hook transmits the integration routing key over cleartext HTTP. |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-18986 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 4.8 | — | Entity Browser Project / entity browser | 2026-09-02 | 2026-09-08 |
| CVE-2026-16647 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal... |
medium | 4.1 | — | Zyxware / disable login page | 2026-09-02 | 2026-09-08 |
| CVE-2026-78593 An insufficiently validated configuration field in Kibana's Cribl integration al... |
medium | 4.3 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-78595 Missing Authorization in Kibana Leading to Information Disclosure / Missing Auth... |
medium | 4.3 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-78596 Missing Authorization in Kibana Leading to Unauthorized Modification of Data / M... |
medium | 4.3 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-82298 Incorrect Authorization (CWE-863) in Kibana can lead to denial of service via Ex... |
medium | 4.3 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-82299 Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure v... |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-86293 A flaw has been found in SourceCodester Simple Traffic Offense System 1.0. |
medium | 6.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86307 A security vulnerability has been detected in light0011 cms c774dce31c6df0055568... |
medium | 4.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86318 A flaw has been found in java-json-tools json-patch up to 1.13. |
medium | 5.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86280 A vulnerability was identified in SourceCodester Syllabus-Aligned Learning Manag... |
medium | 5.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86288 A vulnerability has been found in ModelCloud GPTQModel up to 7.2.0. |
medium | 6.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86216 A security vulnerability has been detected in code-projects Hotel and Tourism Re... |
medium | 4.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86228 A security vulnerability has been detected in JeecgBoot up to 3.9.3. |
medium | 4.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86235 A flaw has been found in itsourcecode Sales and Inventory System 1.0. |
medium | 6.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86171 A security vulnerability has been detected in DefaultFuction CRM 1.0.0. |
medium | 6.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86182 A vulnerability was determined in diem-project diem up to 5.1.3. |
medium | 4.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86150 A security vulnerability has been detected in Tenda CP3 27.5.57.101. |
medium | 4.1 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-4945 The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plu... |
medium | 5.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-19795 Qiskit could allow a local attacker to cause a denial of service due to a stack... |
medium | 6.2 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-81859 CP4BA - IBM Enterprise Records could allow a local attacker to obtain sensitive... |
medium | 6.2 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-5522 IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 005 contains hard-coded credenti... |
medium | 6.7 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-14350 IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 could allow an un... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-6217 Use of a One-Way hash without a salt vulnerability in Pik Online Software Soluti... |
medium | 6.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-18957 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 5.4 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-19043 Missing Authorization vulnerability in Menulux Software Inc. |
medium | 4.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-19057 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 5.4 | — | — | 2026-09-04 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.