September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,313
Critical
1,226
High
4,359
Medium
4,108
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-77823 The LearnPress plugin for WordPress is vulnerable to SQL Injection via the 'orde... |
medium | 4.9 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-83743 A weakness has been identified in invoiceninja Invoice Ninja up to 5.13.26. |
medium | 6.3 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-18488 The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Sc... |
medium | 6.4 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-75964 The User Profile Builder – Beautiful User Registration Forms, User Profiles & Us... |
medium | 6.1 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-75980 The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot... |
medium | 6.4 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-15101 The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Sit... |
medium | 6.4 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-16786 The Live Composer – Free WordPress Website Builder plugin for WordPress is vulne... |
medium | 6.4 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-16788 The Live Composer – Free WordPress Website Builder plugin for WordPress is vulne... |
medium | 6.4 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-77194 The Simple Membership plugin for WordPress is vulnerable to Authentication Bypas... |
medium | 5.3 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-7877 The WP Recipe Maker Premium plugin for WordPress is vulnerable to Stored Cross-S... |
medium | 6.4 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-84061 A security flaw has been discovered in zhongyu09 OpenChatBI up to 0.3.0. |
medium | 6.3 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-84114 A vulnerability has been found in Cleo Harmony up to 5.8.1.10. |
medium | 6.3 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-84153 A vulnerability was determined in Xinhu Rainrock RockOA up to 2.3.2. |
medium | 6.3 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-100882 A vulnerability was detected in Krayin laravel-crm up to 2.2.5. |
low | 2.4 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-97026 Flatpak creates temporary child repository directories under the user cache with... |
low | 3.9 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-93353 copyparty contains a volume restriction bypass vulnerability in its SFTP front e... |
low | 3.1 | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-76736 A buffer overflow vulnerability exists in the underlying operating system of HPE... |
low | 3.3 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-76737 An authenticated path traversal vulnerability exists in the command line interfa... |
low | 3.0 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-95308 Integer overflow in Metrics in Google Chrome prior to 154.0.8037.57 allowed a re... |
low | 3.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102825 Russh is a Rust SSH client and server library. |
low | 3.7 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102621 A vulnerability was identified in Freedesktop Poppler up to 26.08.0. |
low | 3.3 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-44162 fluent-plugin-s3 is an Amazon S3 input and output plugin for Fluentd. |
low | 2.7 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-46696 October System provides the system module for October Content Management System. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-57583 OpenZeppelin Contracts Wizard is a web application to interactively build a cont... |
low | 3.3 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-63630 BentoPDF is a client-side PDF toolkit that is self hostable. |
low | 3.4 | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-55866 SpiceDB is an open source database system for creating and managing security-cri... |
low | 3.7 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-102279 Laravel is a web application framework. |
low | 3.1 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-102601 Flysystem is an open source file storage library for PHP. |
low | 3.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102844 A weakness has been identified in gedelumbung HospitalManagement up to c2d455437... |
low | 2.7 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-54541 Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the... |
low | 3.7 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54542 Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the... |
low | 3.7 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-49400 October System provides the system module for October Content Management System. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-97764 django-allauth before 65.19.4 does not have the expected limits on failed login... |
low | 3.7 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-100837 Contrast (Edgeless Systems) through 1.20.0 performs unanchored suffix matching w... |
low | 3.7 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100866 onefetch through 2.28.1 writes repository information field values to the termin... |
low | 3.3 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-101057 utcp-mcp (the MCP plugin of python-utcp) through 1.1.2 connects to the HTTP and... |
low | 3.1 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-102363 mall4j through 4.0 contains a missing authentication vulnerability in the Delive... |
low | 3.7 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102414 pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on... |
low | 3.7 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-17511 IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31,... |
low | 3.4 | — | Ibm / power system s1122 \(9824-22a\) firmware | 2026-09-24 | 2026-09-30 |
| CVE-2026-18857 IBM OPENBMC FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060... |
low | 3.4 | — | Ibm / power system s1122 \(9824-22a\) firmware | 2026-09-24 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.