September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,314
Critical
1,226
High
4,360
Medium
4,108
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-45519 In screenArgsForPermissionCheckIfAny of multiple locations there is a possible r... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-45521 In openFile of AppFuseBridge.java, there is a possible information disclosure du... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-45525 In multiple locations, there is a possible improper data sanitization due to a l... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-71464 LaunchConfigurationBaseSerializer.scm_branch has no
validate_scm_branch() leadi... |
low | 3.1 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-71465 RunAdHocCommand.build_args() appends limit as bare
positional (args.append(limi... |
low | 3.1 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-84151 The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the W... |
low | 3.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-89004 The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not verify ow... |
low | 2.7 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-93661 The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update r... |
low | 2.7 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-94217 A flaw was found in the User-Managed Access (UMA) implementation of Keycloak. |
low | 3.5 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-94137 A vulnerability was identified in Hangzhou Shunwang Technology shzh 10.7.2.693. |
low | 3.3 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-94150 A security flaw has been discovered in Omega Solution HRM OS up to 20260717. |
low | 2.4 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-94030 A security vulnerability has been detected in SerenityOS up to 3d83e4509fd20d743... |
low | 3.1 | — | — | 2026-09-20 | 2026-09-24 |
| CVE-2026-94045 A security flaw has been discovered in newbee-ltd newbee-mall up to 1.0.0. |
low | 3.5 | — | — | 2026-09-20 | 2026-09-24 |
| CVE-2026-93977 A vulnerability was determined in code-projects Assessment Management 1.0. |
low | 3.5 | — | — | 2026-09-20 | 2026-09-24 |
| CVE-2026-91957 FreeRDP before 3.31.0 contains a use-after-free vulnerability in the smartcard R... |
low | 3.1 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-77860 In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the '... |
low | 3.7 | — | Nlnetlabs / unbound | 2026-09-16 | 2026-09-23 |
| CVE-2026-96549 A vulnerability has been found in sfturing hosp_order up to 627f426331da8086ce8f... |
low | 3.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-28671 In updateInternal of MediaProvider.java, there is a possible expose contents of... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-23 |
| CVE-2026-77756 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')... |
low | 3.7 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-84298 Hatchet is a platform for orchestrating background tasks, AI agents, and durable... |
low | 3.1 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-95958 A security flaw has been discovered in JusticeRage Manalyze 1.0.0. |
low | 3.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-84742 The Events Calendar WordPress plugin before 6.17.5 does not check the capability... |
low | 2.7 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-84743 The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object... |
low | 3.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-87069 The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce,... |
low | 3.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-87074 The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-dr... |
low | 3.7 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-87848 The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authori... |
low | 3.7 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-90951 The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind on... |
low | 3.7 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-91077 The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not... |
low | 2.7 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93507 The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict... |
low | 3.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93528 The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not ver... |
low | 3.7 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-61700 MariaDB Connector/J is used to connect applications developed in Java to MariaDB... |
low | 3.7 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-45723 Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. |
low | 2.7 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-90773 procs through 0.14.12 fails to sanitize escape sequences in process command line... |
low | 3.2 | — | — | 2026-09-13 | 2026-09-23 |
| CVE-2026-87284 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
low | 3.2 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87281 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
low | 3.2 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-92359 A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. |
low | 3.1 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-93676 xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configure... |
low | 3.2 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93600 rustls-webpki (rustls/webpki) versions 0.101.0 through 0.103.11 and 0.104.0-alph... |
low | 2.2 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93601 rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prio... |
low | 2.2 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93986 rclone before 1.75.1 fails to confine names from server and third-party listing... |
low | 3.1 | — | — | 2026-09-19 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.