September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,291
Critical
1,223
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-19888 Missing validation of a mandatory attribute in the SCRAM client-final-message pa... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-6668 Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 a... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93527 Contributor SQL Injection in Live Copy Paste for Elementor <= 1.5.10 versions. |
high | 8.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93622 Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 version... |
high | 7.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93773 Contributor SQL Injection in Mollie Forms <= 2.11.0 versions. |
high | 8.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94124 Contributor SQL Injection in WP EasyCart <= 5.9.4 versions. |
high | 8.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94174 Administrator SQL Injection in Email Log <= 2.63 versions. |
high | 7.6 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94176 Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions. |
high | 7.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94487 Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <... |
high | 8.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95515 Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions. |
high | 7.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95529 Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1... |
high | 7.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95590 Subscriber SQL Injection in Tainacan <= 1.2.0 versions. |
high | 7.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95593 Editor SQL Injection in Ultimeter <= 3.0.8 versions. |
high | 7.6 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95604 Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions. |
high | 7.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-28666 In multiple functions of LocalImageResolver.java, there is a possible Remote Per... |
high | 8.8 | — | Google / android | 2026-09-08 | 2026-09-23 |
| CVE-2026-28668 In LimitRealloc of malloc_limit.cpp, there is a possible use after free due to a... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-23 |
| CVE-2026-45531 In read_boot_region of fsck.c, there is a possible out of bounds read due to a h... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-23 |
| CVE-2026-49879 In multiple functions of rw_t3t.cc, there is a possible out of bounds write due... |
high | 8.8 | — | Google / android | 2026-09-08 | 2026-09-23 |
| CVE-2026-49881 In serviceClassExists of InCallController.java, there is a possible arbitrary co... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-23 |
| CVE-2026-49882 In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible memory safety issue d... |
high | 8.8 | — | Google / android | 2026-09-08 | 2026-09-23 |
| CVE-2026-49884 In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write d... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-23 |
| CVE-2026-96513 A security flaw has been discovered in Neethuharii CafeManagement. |
high | 7.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93970 A security flaw has been discovered in aiyiyi121 SxDevOps 1.0/1.1. |
high | 7.3 | — | — | 2026-09-20 | 2026-09-23 |
| CVE-2026-93368 The Rename wp-login.php to anything you want plugin for WordPress is vulnerable... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93337 NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper input... |
high | 7.8 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-89412 The TranslatePress – Translate Multilingual sites with AI Translation plugin for... |
high | 7.2 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-87022 Improper handling of length parameter inconsistency vulnerability in Apache Tomc... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-79677 Missing release of resource after effective lifetime, Comparison using wrong fac... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-78383 Allocation of resources without limits or throttling vulnerability in Apache Tom... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-78437 Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to... |
high | 7.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-77791 Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-75973 Improper Authentication vulnerability in Apache Tomcat. |
high | 7.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-69443 Out-of-bounds read in Microsoft Azure Attestation service and Device Health Atte... |
high | 7.5 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-23 |
| CVE-2026-85501 Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have be... |
high | 7.5 | — | Nlnetlabs / unbound | 2026-09-16 | 2026-09-23 |
| CVE-2026-84623 An authorization issue was addressed with improved state management. |
high | 7.5 | — | Apple / ipados | 2026-09-14 | 2026-09-23 |
| CVE-2026-49887 In maybeRemoveInvalidInstallerPackageName of InstallRepository.kt, there is a po... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-23 |
| CVE-2026-10575 IBM MQ could allow an authenticated attacker to cause a denial of service or pot... |
high | 8.8 | — | Ibm / mq | 2026-09-18 | 2026-09-23 |
| CVE-2026-49450 Joplin is an open source note-taking and to-do application that organises notes... |
high | 7.1 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-49453 Joplin is an open source note-taking and to-do application that organises notes... |
high | 7.0 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-55210 Joplin is an open source note-taking and to-do application that organises notes... |
high | 7.4 | — | — | 2026-09-21 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.