September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,314
Critical
1,226
High
4,360
Medium
4,108
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-94016 A security flaw has been discovered in SourceCodester Drug Recommendation System... |
low | 2.4 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-83413 Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (compo... |
low | 1.9 | — | Oracle / coherence | 2026-09-15 | 2026-09-22 |
| CVE-2026-83414 Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (compo... |
low | 2.5 | — | Oracle / coherence | 2026-09-15 | 2026-09-22 |
| CVE-2026-95270 A flaw has been found in dgtlmoon changedetection.io up to 0.60.7. |
low | 3.7 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95272 A vulnerability was found in dgtlmoon changedetection.io up to 0.60.7. |
low | 3.7 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-77637 Cloudreve is a self-hosted file management and sharing system. |
low | 3.8 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-92385 A vulnerability has been found in SourceCodester Online Food Ordering System 1.0... |
low | 2.4 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92214 A flaw has been found in a2ui-project a2ui up to 0.10.7. |
low | 3.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-84449 libheif is a HEIF and AVIF file format decoder and encoder. |
low | 3.7 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-94033 A vulnerability has been found in SourceCodester Drug Recommendation System 1.0. |
low | 3.5 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-93975 A vulnerability has been found in code-projects Assessment Management 1.0. |
low | 2.4 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-81181 SysReptor is a fully customizable pentest reporting platform. |
low | 3.7 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-94210 A flaw has been found in Hyve5 Leantime up to 3.9.8. |
low | 3.5 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-93968 A vulnerability was determined in aiyiyi121 SxDevOps 1.0/1.1. |
low | 3.8 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-85478 A CM2507 IP camera running firmware version HMT.CM2507 v251211.1507 exposes an i... |
low | 3.5 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-83369 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
low | 3.1 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-86887 A privacy issue was addressed by removing sensitive data. |
low | 3.3 | — | Apple / ipados | 2026-09-14 | 2026-09-21 |
| CVE-2026-86888 A permissions issue was addressed with additional restrictions. |
low | 3.3 | — | Apple / ipados | 2026-09-14 | 2026-09-21 |
| CVE-2026-87031 n Concrete CMS 9.2.0 through 9.5.3, the REST API user creation endpoint (POST /c... |
low | 2.7 | — | Concretecms / concrete cms | 2026-09-16 | 2026-09-21 |
| CVE-2026-18425 Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action (Con... |
low | 2.7 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-21 |
| CVE-2026-94145 A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. |
low | 3.5 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94211 A vulnerability has been found in Hyve5 Leantime up to 3.9.8. |
low | 2.4 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94034 A vulnerability was found in SourceCodester Drug Recommendation System 1.0. |
low | 3.5 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-93956 A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. |
low | 3.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-93976 A vulnerability was found in code-projects Assessment Management 1.0. |
low | 2.4 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-86802 The To Do List Member WordPress plugin through 1.6 does not have authorisation o... |
low | 3.7 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-92403 The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify... |
low | 3.7 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-92420 The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin b... |
low | 3.8 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-81651 The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not... |
low | 3.1 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-81652 The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not... |
low | 2.7 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-81654 The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not... |
low | 3.1 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-92423 The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capabil... |
low | 2.7 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-93378 Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed... |
low | 3.1 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-93380 Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a r... |
low | 3.1 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-91836 A flaw has been found in OpenClaw ClawScan up to 0.1.6. |
low | 2.8 | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-84400 CareCam CM2507 IP cameras contain an insufficiently protected network maintenanc... |
low | 3.1 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-93650 A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. |
low | 3.7 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-68493 After guessing a 62^15 complex unique identifier, a malicious logged in user was... |
low | 3.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-13666 An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in... |
low | 3.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-84626 An information disclosure issue was addressed with improved state management. |
low | 3.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.