September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,319
Critical
1,226
High
4,360
Medium
4,108
Low
460
Severity not reported
1,165
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86487 In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed re... |
low | 3.1 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86491 In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project an... |
low | 3.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86501 In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be writt... |
low | 2.8 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86503 In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could tr... |
low | 3.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86505 In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked pr... |
low | 3.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-45197 Kernel software installed and running inside a Guest VM may post improper comman... |
low | 2.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-86301 A vulnerability has been found in code-projects Hospital Information System 1.0. |
low | 3.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-85207 A vulnerability was identified in itsourcecode Online Medicine Delivery System 1... |
low | 3.5 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-85030 A vulnerability has been found in HKUDS AI-Trader up to d03ff6c056b32ced735adf7c... |
low | 3.7 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-78600 Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to un... |
low | 3.5 | — | Elastic / elastic cloud on kubernetes | 2026-09-02 | 2026-09-03 |
| CVE-2026-78587 Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of servic... |
low | 3.1 | — | Elastic / fleet server | 2026-09-02 | 2026-09-03 |
| CVE-2026-77783 The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post... |
low | 3.7 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-77784 The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is... |
low | 2.7 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-77785 The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the reque... |
low | 2.7 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-77787 The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability... |
low | 2.7 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81196 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not pro... |
low | 2.7 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81198 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not pro... |
low | 3.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-14326 The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownersh... |
low | 3.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-19698 The GutenKit WordPress plugin before 2.5.1 does not validate or escape style set... |
low | 3.5 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2023-3360 The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of... |
low | 3.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84355 Incorrect authorization in Navigation in Google Chrome prior to 152.0.7977.75 al... |
low | 3.1 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-85022 A vulnerability was identified in langgenius dify 1.13.0. |
low | 3.5 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84359 Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remot... |
low | 3.1 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84328 Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allo... |
low | 3.1 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84331 Incorrect authorization in Actor in Google Chrome prior to 152.0.7977.75 allowed... |
low | 3.1 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-48932 A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-... |
low | 3.7 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-84437 A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. |
low | 3.5 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-73743 A vulnerability in the web-based management interface of HPE Networking Fabric C... |
low | 3.7 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-03 |
| CVE-2026-73745 A vulnerability in the API endpoint of HPE Networking Fabric Composer could allo... |
low | 3.1 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73744 A denial-of-service vulnerability exists in the web-based management interface o... |
low | 3.5 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73746 A denial-of-service vulnerability exists in the API of HPE Networking Fabric Com... |
low | 3.1 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73747 A local privilege-escalation vulnerability has been discovered in HPE Networking... |
low | 2.5 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73748 A vulnerability in the affected interface of HPE Networking Fabric Composer allo... |
low | 2.2 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-84438 A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. |
low | 3.5 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-75969 Missing authentication for critical function vulnerability for all PTZOptics cam... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-18825 An Origin Validation Error in the middleware of the connect-xcors npm package al... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-103443 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vu... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103444 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vu... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103445 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vu... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103437 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vu... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.