September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,314
Critical
1,226
High
4,360
Medium
4,108
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-90611 A vulnerability was determined in GPAC up to f1219cde. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90842 A weakness has been identified in PHPGurukul Blood Donor Management System 1.0. |
low | 3.7 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90622 A security flaw has been discovered in GNU libredwg 0.13.4. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90683 A vulnerability was detected in GPAC up to f1219cde. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-63020 A vulnerability exists in an undisclosed BIG-IP Configuration utility page that... |
low | 3.1 | — | F5 / big-ip access policy manager | 2026-09-02 | 2026-09-15 |
| CVE-2026-84653 Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both... |
low | 3.5 | — | Jenkins / jenkins | 2026-09-02 | 2026-09-15 |
| CVE-2026-90824 A vulnerability has been found in GPAC 26.07.0. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90529 A vulnerability has been found in DataEase up to 2.10.25/2.10.26. |
low | 3.5 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90567 A security vulnerability has been detected in quequnlong shiyi-blog up to 1.2.1. |
low | 3.5 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90503 A flaw has been found in Chengdu Qilu Technology Ludashi 6.1026.4715.714. |
low | 2.3 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90508 A security flaw has been discovered in Chengdu Qilu Technology Ludashi 6.1026.47... |
low | 3.4 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90827 A vulnerability was identified in GPAC 26.07.0. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90835 A flaw has been found in michaelliao itranswarp up to 2.19. |
low | 3.5 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90845 A flaw has been found in PHPGurukul Daily Expense Tracker System 1.1. |
low | 3.5 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90850 A vulnerability was detected in PHPGurukul Hostel Management System 3.0. |
low | 2.4 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-28582 In onCreate of ConfirmDeviceCredentialActivity.java, there is a possible unautho... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-0054 In isCallerAllowed of WalletContextualLocationsService.kt, there is a possible w... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-90713 A security flaw has been discovered in vllm-project vLLM up to 0.29.0. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90610 A vulnerability was found in GPAC up to f1219cde. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-28630 In onCreate of ContactsPickerActivity.kt, there is a possible misleading UI due... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28623 In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28622 In getQueryBuilderInternal of MediaProvider.java, there is a possible way to ret... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28660 In getAllSessions of multiple files, there is a possible confused deputy due to... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28652 In multiple functions of RangingServiceImpl.java, there is a possible MITM due t... |
low | 3.1 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28638 In multiple functions of XmpDataParser.java, there is a possible improper data s... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-82851 The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or... |
low | 2.7 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-84025 The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on seve... |
low | 2.2 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-86407 The User Registration & Membership WordPress plugin before 5.2.8 does not verify... |
low | 3.7 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90497 A vulnerability was determined in Fengoffice Feng Office up to 3.11.13.11. |
low | 3.5 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90502 A vulnerability was detected in stilleshan ServerStatus 1.0/2.0. |
low | 3.5 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90528 A flaw has been found in TDuckApp tduck-platform up to 5.3. |
low | 3.5 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90564 A vulnerability was identified in quequnlong shiyi-blog 1.0.0-1.2.1. |
low | 3.5 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90569 A flaw has been found in linlinjava litemall 1.5.0/1.6.0/1.7.0/1.8.0. |
low | 2.4 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90576 A security vulnerability has been detected in GPAC up to f1219cde. |
low | 3.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90602 A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.... |
low | 3.5 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90604 A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. |
low | 3.5 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90609 A vulnerability has been found in GPAC up to f1219cde. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90612 A vulnerability was identified in GPAC up to f1219cde. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90623 A weakness has been identified in andreashappe cochise up to 0.4.1. |
low | 3.7 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90681 A weakness has been identified in Matthias-Wandel jhead up to 3.3. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.