September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,314
Critical
1,226
High
4,360
Medium
4,108
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-91782 A vulnerability was detected in GNU Binutils 2.47. |
low | 3.3 | — | Gnu / binutils | 2026-09-15 | 2026-09-17 |
| CVE-2026-91090 A vulnerability was determined in GPAC up to f1219cde. |
low | 3.9 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-91708 Race condition in Network in Google Chrome prior to 153.0.8010.47 allowed a remo... |
low | 3.1 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-89327 The FluentBoards WordPress plugin before 2.0.15 does not verify that a board mem... |
low | 3.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-89328 The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a... |
low | 3.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-86448 The LearnPress WordPress plugin before 4.4.7 does not perform any authentication... |
low | 3.7 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-84905 The Eventin WordPress plugin before 4.1.24 does not verify a user's capability t... |
low | 2.7 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-84907 The Eventin WordPress plugin before 4.1.24 does not properly authorise order fin... |
low | 3.7 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-82126 The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not... |
low | 2.7 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-18540 undici's retry interceptor can append the body of a ranged retry response to byt... |
low | 3.7 | — | Nodejs / undici | 2026-09-04 | 2026-09-16 |
| CVE-2026-75943 A brief (milliseconds to seconds) traffic leak may occur when an authenticated s... |
low | 2.6 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-75944 A race condition during supplicant re-authentication may leave a stale ACL entry... |
low | 2.6 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-75945 A race condition may cause a supplicant to remain in an authorized state after a... |
low | 2.6 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-77191 An authenticated supplicant on an adjacent network may bypass intended network a... |
low | 2.6 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-86763 Snipe-IT versions >= 7.0.12 and <= 8.6.3 contain an authorization bypass in the... |
low | 3.5 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-16592 The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization... |
low | 2.7 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-81159 Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allow... |
low | 3.7 | — | Centarro / commerce cybersource | 2026-09-02 | 2026-09-16 |
| CVE-2026-45761 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
low | 3.3 | — | Oisf / suricata | 2026-09-10 | 2026-09-16 |
| CVE-2026-90573 A vulnerability was identified in GPAC up to f1219cde. |
low | 3.3 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90568 A vulnerability was detected in moxi624 Mogu Blog v2 up to 5.2. |
low | 3.5 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90563 A vulnerability was determined in maliangnansheng bbs-springboot 3.0.0. |
low | 3.5 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2023-37252 An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. |
low | 3.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2023-37253 An issue was discovered in the ProofreadPage extension for MediaWiki through 1.3... |
low | 3.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-86701 Android application "ManabiPocket for Parents" contains an improper access contr... |
low | 2.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-16190 IBM WebSphere Application Server 9.0, and 8.5 is affected by an authorization by... |
low | 3.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-19086 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a denial of service as a result of a bu... |
low | 3.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-89162 In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adv... |
low | 3.3 | — | Pcre / pcre2 | 2026-09-11 | 2026-09-16 |
| CVE-2026-91835 A vulnerability was detected in OpenClaw ClawScan up to 0.1.6. |
low | 2.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-90826 A vulnerability was determined in GPAC 26.07.0. |
low | 2.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-46460 Dell PowerScale OneFS, versions 9.5.0.0 through 9.7.1.15, versions 9.8.0.0 throu... |
low | 3.5 | — | Dell / powerscale onefs | 2026-09-09 | 2026-09-16 |
| CVE-2026-91781 A security vulnerability has been detected in GNU Binutils 2.47. |
low | 3.3 | — | Gnu / binutils | 2026-09-15 | 2026-09-16 |
| CVE-2026-91780 A weakness has been identified in GNU Binutils 2.47. |
low | 3.3 | — | Gnu / binutils | 2026-09-15 | 2026-09-16 |
| CVE-2026-91779 A security flaw has been discovered in GNU Binutils 2.47. |
low | 3.3 | — | Gnu / binutils | 2026-09-15 | 2026-09-16 |
| CVE-2026-90695 A vulnerability was found in SourceCodester Inventory Management System 1.0. |
low | 3.5 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90685 A vulnerability has been found in GPAC up to f1219cde. |
low | 2.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90613 A security flaw has been discovered in GPAC up to f1219cde. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90575 A weakness has been identified in PHPGurukul Small CRM 4.0. |
low | 3.7 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90570 A vulnerability has been found in linlinjava litemall 1.4.0/1.5.0/1.6.0/1.7.0/1.... |
low | 2.4 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90825 A vulnerability was found in GPAC 26.07.0. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-86141 xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewPa... |
low | 3.3 | — | Xmlsoft / libxml2 | 2026-09-05 | 2026-09-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.