September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,314
Critical
1,226
High
4,360
Medium
4,108
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-97150 When converting baserCMS4-style addons to baserCMS5-style ones,
BcAddonMigrator... |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-71302 The application accepts user-supplied session identifiers and does not regenerat... |
high | 7.1 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-84409 The device's update mechanism retrieves metadata for software updates over an un... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-91191 The device's update mechanism includes conditions that allow unauthorized softwa... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-77422 JLine is a Java library for handling console input. |
high | 7.5 | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-77423 JLine is a Java library for handling console input. |
high | 7.5 | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-71971 U-Boot before 2026.10-rc3 with CONFIG_IP_DEFRAG enabled contains an out-of-bound... |
high | 8.2 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-74220 U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_read_reply() functio... |
high | 8.2 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-74221 U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() fun... |
high | 8.2 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-103229 A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7... |
high | 7.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-95274 Improper output encoding in DevTools in Google Chrome prior to 154.0.8037.57 all... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95276 Improper input validation in Themes in Google Chrome prior to 154.0.8037.57 allo... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-100700 nodemailer before 10.0.6 contains a denial of service vulnerability in the addre... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100372 ClipBucket v5 before 5.5.3-#197 contains a path traversal vulnerability in the a... |
high | 7.2 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-95280 Race condition in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote at... |
high | 7.5 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95286 Type confusion in Bindings in Google Chrome prior to 154.0.8037.57 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102454 EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-95282 Use after free in Platform in Google Chrome prior to 154.0.8037.57 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95315 Use after free in Aura in Google Chrome prior to 154.0.8037.57 allowed a local a... |
high | 7.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95319 Use after free in Printing in Google Chrome prior to 154.0.8037.57 allowed a rem... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-75823 The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with... |
high | 7.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-85573 The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site'... |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-88797 The Vayu X WordPress theme before 1.0.6 does not perform any capability check on... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-89193 The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values t... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-91832 The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the non... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-92994 The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not va... |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-95333 Use after free in Metrics in Google Chrome prior to 154.0.8037.57 allowed a remo... |
high | 8.1 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95334 Incorrect reference resolution in WebProtect in Google Chrome prior to 154.0.803... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95335 Use after free in HID in Google Chrome prior to 154.0.8037.57 allowed a remote a... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95338 Use after free in PDFium in Google Chrome prior to 154.0.8037.57 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95341 Improper input validation in Desktop in Google Chrome prior to 154.0.8037.57 all... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95343 Use after free in WebAudio in Google Chrome prior to 154.0.8037.57 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95345 Use after free in Actor in Google Chrome prior to 154.0.8037.57 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95348 Use after free in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed a re... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95351 Use after free in Views in Google Chrome prior to 154.0.8037.57 allowed a remote... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95353 Use after free in Bindings in Google Chrome prior to 154.0.8037.57 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95354 Use after free in Verifier in Google Chrome prior to 154.0.8037.57 allowed a rem... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95355 Incorrect authorization in Navigation in Google Chrome on on iOS prior to 154.0.... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-96649 The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin pl... |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97347 The Post Views Stats Counter plugin for WordPress is vulnerable to Stored Cross-... |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.