September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,293
Critical
1,225
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84766 Unauthenticated Bypass Vulnerability in FluentBooking Pro <= 2.2.1 versions. |
medium | 5.9 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-84774 Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.11 versions... |
medium | 6.1 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-81281 Subscriber Cross Site Scripting (XSS) in Graphene <= 2.9.4 versions. |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-84886 A vulnerability was determined in simular-ai Agent-S up to 0.3.2. |
medium | 5.3 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-84666 Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier allows... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-56143 Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch... |
medium | 4.9 | — | Elastic / elasticsearch | 2026-09-01 | 2026-09-04 |
| CVE-2026-72633 Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss... |
medium | 4.3 | — | Elastic / kibana | 2026-09-01 | 2026-09-04 |
| CVE-2026-85241 A weakness has been identified in SpecterOps BloodHound up to 9.5.1. |
medium | 6.3 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-85382 A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99... |
medium | 4.3 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-85401 A weakness has been identified in Dolibarr up to 21.0.4/22.0.5/23.0.3. |
medium | 6.3 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-27432 Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vi... |
medium | 5.4 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-32480 Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiti... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-27347 Missing Authorization vulnerability in Crocoblock JetPopup allows Exploiting Inc... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-85514 A security vulnerability has been detected in StackStorm st2 up to 3.9.0. |
medium | 6.3 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-78609 Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead... |
medium | 5.4 | — | Elastic / elastic cloud on kubernetes | 2026-09-02 | 2026-09-04 |
| CVE-2026-73762 A vulnerability has been identified in the API endpoint of AOS-CX that could all... |
medium | 6.6 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73761 An out-of-bounds read vulnerability exists in the underlying operating system of... |
medium | 6.5 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73760 An authenticated Path Traversal vulnerability exists in AOS-CX. |
medium | 6.5 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73758 A privilege escalation vulnerability exists in the API endpoint of AOS-CX. |
medium | 6.5 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73757 A vulnerability in the web-based management interface of AOS-CX could allow an a... |
medium | 6.4 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73756 A vulnerability in an API endpoint of AOS-CX could allow a remote unauthenticate... |
medium | 5.9 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73755 A privilege escalation vulnerability exists in the API endpoint of AOS-CX. |
medium | 5.7 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73754 Denial-of-service vulnerabilities exist in the command line interface of AOS-CX. |
medium | 5.3 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73772 Buffer overflow vulnerabilities exist in an underlying service of AOS-CX that co... |
medium | 6.5 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-85186 A weakness has been identified in itsourcecode Online Medicine Delivery System 1... |
medium | 6.3 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-85306 Missing Authorization vulnerability in Cascadia Web Services MountDev AI MCP Con... |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-81282 Subscriber Cross Site Scripting (XSS) in Product Variations Swatches for WooComm... |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-84754 Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions. |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-84767 Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions. |
medium | 5.3 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-84780 Unauthenticated Denial of Service Attack in WP Go Maps <= 10.1.08 versions. |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-84799 Craft CMS before 5.11.0 fails to enforce user-group scope filters on native Grap... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-84804 Kimai before 2.65.0 fails to properly validate permissions when removing team ac... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-84427 A vulnerability was determined in zhayujie CowAgent up to 2.1.7. |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-84269 A flaw was found in the AFP backend in gvfs. |
medium | 6.5 | — | — | 2026-09-01 | 2026-09-04 |
| CVE-2026-84287 A flaw has been found in NousResearch hermes-agent 0.18.0. |
medium | 4.3 | — | — | 2026-09-01 | 2026-09-04 |
| CVE-2026-3850 The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via th... |
medium | 6.4 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-84110 A vulnerability was detected in Releasit Releasit COD Form & Upsells v1. |
medium | 5.3 | — | — | 2026-09-01 | 2026-09-04 |
| CVE-2026-3851 The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via th... |
medium | 6.4 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-78594 Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to... |
medium | 4.9 | — | Elastic / apm server | 2026-09-02 | 2026-09-03 |
| CVE-2026-78588 Allocation of Resources Without Limits or Throttling (CWE-770) in Filebeat can l... |
medium | 6.5 | — | Elastic / filebeat | 2026-09-02 | 2026-09-03 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.