September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,313
Critical
1,226
High
4,359
Medium
4,108
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-81655 The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict acces... |
high | 7.5 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-86609 The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape... |
high | 8.8 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-96795 Horilla is an HR and CRM software. |
high | 8.8 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-75907 The door access control on a Norwegian Cruise Line asset grants entry based only... |
high | 7.5 | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-5267 Ciena Navigator Network
Control Suite (NCS) contains an information exposure vul... |
high | 7.5 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-80357 Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contai... |
high | 7.0 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-69459 Heap-based buffer overflow in Windows Power Dependency Coordinator allows an aut... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-28 |
| CVE-2026-69460 Use after free in Windows Modern Device Management (MDM) allows an authorized at... |
high | 7.1 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-28 |
| CVE-2026-69462 Heap-based buffer overflow in Windows Error Reporting allows an authorized attac... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-69468 Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-69470 Use after free in Windows Connected User Experiences and Telemetry allows an aut... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-95655 Aureus ERP before 1.5.0 fails to scope message lookups to the current record in... |
high | 8.1 | — | — | 2026-09-22 | 2026-09-28 |
| CVE-2026-94609 authentik is an open-source identity provider. |
high | 8.8 | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-93659 Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields... |
high | 8.1 | — | — | 2026-09-18 | 2026-09-28 |
| CVE-2026-19477 There
is stack-based buffer overflow vulnerability recently discovered in MCC Un... |
high | 7.8 | — | — | 2026-09-17 | 2026-09-28 |
| CVE-2026-21086 Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows lo... |
high | 7.8 | — | Samsung / android | 2026-09-09 | 2026-09-28 |
| CVE-2026-95847 Moquette is a lightweight Java MQTT broker. |
high | 7.5 | — | Moquette / moquette | 2026-09-23 | 2026-09-28 |
| CVE-2026-83439 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: hel... |
high | 8.1 | — | Oracle / helidon | 2026-09-15 | 2026-09-28 |
| CVE-2026-100705 Kyverno before 1.19.1 is vulnerable to server-side request forgery. |
high | 7.6 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-96896 The Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin before 19... |
high | 7.2 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-93435 redis-parser through 3.0.0 contains a denial of service vulnerability in the RES... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-28 |
| CVE-2026-93349 Frictionless before 5.19.1 contains an OS command injection vulnerability in the... |
high | 8.8 | — | — | 2026-09-23 | 2026-09-28 |
| CVE-2026-85056 ZITADEL is an open source identity management platform. |
high | 8.2 | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-42323 Piwigo is a full featured open source photo gallery application for the web. |
high | 7.2 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-100708 Froxlor before 2.3.13 returns the ssl_key_file column — which stores the raw PEM... |
high | 7.1 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-96524 The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly ve... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-96532 The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capabi... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-97865 A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. |
high | 7.3 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-97871 A vulnerability has been found in Zhonglun CloudPos up to 3.0.1.76. |
high | 7.3 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-97877 A vulnerability was determined in zhistaredu StarTraining up to 3.8.1. |
high | 7.3 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-97878 A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. |
high | 7.3 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-97883 A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Pr... |
high | 7.3 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-97885 A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098... |
high | 7.3 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-77203 The Groups – Memberships and Access Control plugin for WordPress is vulnerable t... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100746 A vulnerability was found in coollabsio Coolify up to 4.1.0. |
high | 7.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100874 A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098... |
high | 7.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100875 A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to... |
high | 7.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100889 A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. |
high | 7.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100893 A vulnerability was determined in Privoce VoceChat Server up to 0.5.36. |
high | 7.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100901 A vulnerability was found in athlon1600 youtube-downloader up to 4.0.1. |
high | 7.3 | — | — | 2026-09-28 | 2026-09-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.