September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,319
Critical
1,226
High
4,360
Medium
4,108
Low
460
Severity not reported
1,165
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-79736 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
low | 3.7 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-79942 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
low | 3.4 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-79944 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
low | 3.4 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-80239 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
low | 2.4 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-79727 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
low | 3.3 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-87485 Incorrect authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87498 Missing authorization in WebUI in Google Chrome prior to 153.0.8010.36 allowed a... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87517 Race condition in Mobile in Google Chrome on on iOS prior to 153.0.8010.36 allow... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87531 Information leak in CORS in Google Chrome prior to 153.0.8010.36 allowed a remot... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87652 Incorrect authorization in PushAPI in Google Chrome prior to 153.0.8010.36 allow... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-81168 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal... |
low | 3.7 | — | Captcha Protected Page Project / captcha protected page | 2026-09-02 | 2026-09-09 |
| CVE-2026-87521 Information leak in WebMCP in Google Chrome prior to 153.0.8010.36 allowed a rem... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87452 Incorrect authorization in GPU in Google Chrome on on Mac prior to 153.0.8010.36... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87611 Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allo... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-69904 Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an auth... |
low | 3.5 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-87451 Information leak in Downloads in Google Chrome prior to 153.0.8010.36 allowed a... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-13144 The WP Travel WordPress plugin before 12.0.2 does not properly verify that the r... |
low | 3.7 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-13146 The WP Travel WordPress plugin before 12.0.2 does not properly verify that the r... |
low | 3.7 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-81846 An authorization bypass in the runZero Platform MCP service has been resolved in... |
low | 3.5 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-86564 A flaw was found in DPDK lib/vhost. |
low | 3.3 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-86227 A weakness has been identified in valkey-io valkey up to 9.0.5/9.1.1. |
low | 3.1 | — | — | 2026-09-06 | 2026-09-09 |
| CVE-2026-86181 A vulnerability was found in code-projects Task Management System 1.0. |
low | 3.5 | — | — | 2026-09-06 | 2026-09-09 |
| CVE-2026-76961 SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cr... |
low | 3.5 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-18743 A flaw was found in popt. |
low | 2.5 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-85592 phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the ques... |
low | 3.7 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-86670 A flaw has been found in aircheng-org iWebShop-5 up to 5.15. |
low | 3.7 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-84066 The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPr... |
low | 3.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-58234 SAP Process Integration (SOAP Adapter) allows a privileged user to send speciall... |
low | 2.2 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-76960 SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cr... |
low | 3.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-78150 The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership... |
low | 2.7 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-81348 The My Private Site WordPress plugin before 4.2.3 does not apply its site-privac... |
low | 3.7 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84225 The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to... |
low | 2.2 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84745 The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-publi... |
low | 2.7 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84926 The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access... |
low | 2.7 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84927 The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient autho... |
low | 2.7 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86644 A vulnerability was determined in star7th showdoc up to 3.9.1. |
low | 3.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86226 A security flaw has been discovered in Projectwolds Online Attendance System 1.0... |
low | 3.5 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-85052 Out of bounds read in CrashReporting in Google Chrome prior to 152.0.7977.82 all... |
low | 3.1 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-86485 In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed f... |
low | 3.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86486 In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed... |
low | 3.7 | — | — | 2026-09-07 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.