September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,314
Critical
1,226
High
4,360
Medium
4,108
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-28199 An authenticated user with access to the NetBackup Flex OS management
shell cou... |
low | 3.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-87026 Tanium addressed an improper access controls vulnerability in Threat Response. |
low | 3.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92473 A vulnerability was identified in GPAC 26.08-DEV. |
low | 3.3 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-93505 A vulnerability was found in SveltyCMS 0.0.6. |
low | 3.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-16512 gptp_handle_msg() in subsys/net/l2/ethernet/gptp/gptp.c dereferenced the gPTP he... |
low | 3.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-86446 The LearnPress WordPress plugin before 4.4.7 does not restrict the correctness f... |
low | 3.7 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-87836 The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its... |
low | 2.7 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-91008 The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not... |
low | 3.7 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-91017 The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does... |
low | 3.7 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-81340 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not per... |
low | 3.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-84903 The King Addons for Elementor WordPress plugin before 51.1.81 does not perform a... |
low | 2.7 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-84904 The King Addons for Elementor WordPress plugin before 51.1.81 does not perform p... |
low | 3.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-88844 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not ver... |
low | 2.7 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-89007 The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does... |
low | 2.7 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-89008 The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does... |
low | 2.7 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-13683 An improper neutralization of special elements used in an SQL command ('SQL Inje... |
low | 2.7 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-40538 An improper restriction of excessive authentication attempts vulnerability in Au... |
low | 3.7 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-92381 A weakness has been identified in PbootCMS up to 3.2.22. |
low | 3.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-90489 A vulnerability was identified in Xuxueli xxl-job up to 3.5.0. |
low | 3.5 | — | — | 2026-09-13 | 2026-09-18 |
| CVE-2026-86744 Snipe-IT 8.6.3 and earlier (and develop pre-release commits prior to the fix) co... |
low | 2.2 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-18 |
| CVE-2026-81178 SysReptor is a fully customizable pentest reporting platform. |
low | 3.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-61633 NanoMQ is an MQTT broker. |
low | 2.0 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-44639 NanoMQ is an MQTT broker. |
low | 3.7 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-84530 An information disclosure issue was addressed with improved memory management. |
low | 3.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-93384 Server-side request forgery in Omnibox in Google Chrome on on Android prior to 1... |
low | 3.7 | — | Google / chrome | 2026-09-17 | 2026-09-18 |
| CVE-2026-86893 A permissions issue was addressed with additional restrictions. |
low | 3.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-81922 Concrete CMS before 9.5.3 did not enforce a per-page authorization check when re... |
low | 2.7 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-18 |
| CVE-2026-81923 In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check... |
low | 2.7 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-18 |
| CVE-2026-65371 This issue was addressed with improved redaction of sensitive information. |
low | 3.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-86891 An authorization issue was addressed with improved state management. |
low | 3.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-91723 Race condition in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed... |
low | 3.1 | — | Google / chrome | 2026-09-15 | 2026-09-18 |
| CVE-2026-92130 Jenkins Pipeline: Multibranch Plugin 841.vec5b_9e1806ec and earlier does not set... |
low | 3.1 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20071 A vulnerability in the SSID bring-your-own-device (BYOD) onboarding workflow of... |
low | 3.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92418 A vulnerability was determined in ChangeWeDer crm up to c07bd4c97141521af6475034... |
low | 3.5 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-92472 A vulnerability was determined in GPAC 26.08-DEV. |
low | 3.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-92474 A security flaw has been discovered in GPAC 26.08-DEV. |
low | 3.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-73442 On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP... |
low | 3.0 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-91747 Use after free in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote... |
low | 3.1 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91730 Incomplete cleanup in GetUserMedia in Google Chrome prior to 153.0.8010.47 allow... |
low | 3.1 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91926 A flaw was found in gss-ntlmssp. |
low | 3.7 | — | — | 2026-09-15 | 2026-09-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.