September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,291
Critical
1,223
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84714 A flaw was found in the automation-controller input-validation
guard sanitize_j... |
high | 7.1 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-56736 phpMyFAQ is an open source FAQ web application. |
high | 8.2 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-69322 Double free in Microsoft Windows Search Component allows an authorized attacker... |
high | 8.0 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69328 Untrusted search path in Windows Storage allows an authorized attacker to elevat... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-44236 rabbitmq-c is a C-language AMQP client library for RabbitMQ. |
high | 7.1 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-96826 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-84691 A flaw was found in Red Hat Ansible Automation Platform's automation-
controller... |
high | 8.7 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-69377 Missing authorization in Windows Modern Device Management (MDM) allows an author... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-24 |
| CVE-2026-15027 CGServiSign developed by Changing has a OS Command Injection vulnerability. |
high | 8.8 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96556 A flaw has been found in Neethuharii CafeManagement. |
high | 7.3 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96603 A vulnerability has been found in Abdurrab5 online-makeup-store. |
high | 7.3 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-19125 The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication B... |
high | 8.1 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-86583 The Import and export users and customers plugin for WordPress is vulnerable to... |
high | 8.8 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-80513 The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes m... |
high | 7.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-88843 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not val... |
high | 7.2 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96803 A vulnerability was identified in java110 MicroCommunity up to 2.0. |
high | 7.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-77193 The eesy_ID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Pa... |
high | 7.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-94144 A flaw has been found in drogonframework drogon up to 1.9.13. |
high | 7.3 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-12370 ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Man... |
high | 7.6 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-92239 A maliciously constructed IMAP line could cause an out-of-bounds buffer read. |
high | 8.1 | — | Mozilla / thunderbird | 2026-09-15 | 2026-09-24 |
| CVE-2026-69279 Use after free in Windows Cloud Files Mini Filter Driver allows an authorized at... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69281 Use after free in Windows License Manager allows an authorized attacker to eleva... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-24 |
| CVE-2026-88410 The graph.UDF in FalkorDB (Redis module) v4.20.1 to v4.20.4 is not registered as... |
high | 7.1 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2025-48384 Git Link Following Vulnerability |
high | 8.0 | Listed | Git / Git | 2025-07-08 | 2026-09-24 |
| CVE-2025-8875 N-able N-Central Insecure Deserialization Vulnerability |
high | 7.8 | Listed | N-able / N-Central | 2025-08-14 | 2026-09-24 |
| CVE-2024-48248 NAKIVO Backup and Replication Absolute Path Traversal Vulnerability |
high | 8.6 | Listed | NAKIVO / Backup and Replication | 2025-03-04 | 2026-09-24 |
| CVE-2025-30066 tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability |
high | 8.6 | Listed | Tj-actions / changed-files GitHub Action | 2025-03-15 | 2026-09-24 |
| CVE-2025-24993 Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability |
high | 7.8 | Listed | Microsoft / Windows | 2025-03-11 | 2026-09-24 |
| CVE-2025-26633 Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability |
high | 7.0 | Listed | Microsoft / Windows | 2025-03-11 | 2026-09-24 |
| CVE-2025-21391 Microsoft Windows Storage Link Following Vulnerability |
high | 7.1 | Listed | Microsoft / Windows | 2025-02-11 | 2026-09-24 |
| CVE-2025-21335 Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability |
high | 7.8 | Listed | Microsoft / Windows | 2025-01-14 | 2026-09-24 |
| CVE-2026-80097 Improper authentication in Microsoft Authenticator allows an unauthorized attack... |
high | 8.6 | — | Microsoft / authenticator | 2026-09-08 | 2026-09-24 |
| CVE-2026-69299 Use after free in Microsoft COM for Windows allows an authorized attacker to ele... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-24 |
| CVE-2008-4128 Cisco IOS Cross-Site Request Forgery Vulnerability |
high | 8.1 | Listed | Cisco / IOS | 2008-09-18 | 2026-09-24 |
| CVE-2026-93972 A security vulnerability has been detected in SourceCodester Online Reviewer Man... |
high | 7.3 | — | — | 2026-09-20 | 2026-09-24 |
| CVE-2026-94104 NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the Fi... |
high | 8.8 | — | — | 2026-09-20 | 2026-09-24 |
| CVE-2026-91955 FreeRDP before 3.31.0 fails to validate client-supplied DesktopWidth and Desktop... |
high | 7.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-84486 A flaw was found in Red Hat Ansible Automation Platform's automation-
controller... |
high | 8.2 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96804 MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOW_ALLOW_PIC... |
high | 8.8 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-86677 ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a l... |
high | 8.8 | — | — | 2026-09-23 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.