September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,291
Critical
1,223
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-83485 Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (comp... |
high | 7.7 | — | Oracle / product hub | 2026-09-15 | 2026-09-22 |
| CVE-2026-83486 Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (comp... |
high | 7.7 | — | Oracle / product hub | 2026-09-15 | 2026-09-22 |
| CVE-2026-83487 Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (comp... |
high | 7.7 | — | Oracle / product hub | 2026-09-15 | 2026-09-22 |
| CVE-2026-83490 Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (com... |
high | 8.5 | — | Oracle / irecruitment | 2026-09-15 | 2026-09-22 |
| CVE-2026-87127 Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (compo... |
high | 7.7 | — | Oracle / purchasing | 2026-09-15 | 2026-09-22 |
| CVE-2026-87124 Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (com... |
high | 7.7 | — | Oracle / irecruitment | 2026-09-15 | 2026-09-22 |
| CVE-2026-94403 A weakness has been identified in ColorFul iGameCenter 1.0.3.4. |
high | 8.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94424 A vulnerability has been found in Moore Threads MTT S80 Driver Package up to 340... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94425 A vulnerability was found in Moore Threads MTT S80 Driver Package 340.150. |
high | 8.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-12470 The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress i... |
high | 7.2 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-94504 Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it wit... |
high | 7.2 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-6922 The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnera... |
high | 7.1 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-92235 The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary short... |
high | 8.1 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-92969 The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is... |
high | 8.1 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-93778 The WP Yelp Review Slider plugin for WordPress is vulnerable to Stored Cross-Sit... |
high | 7.2 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-93836 The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to St... |
high | 7.2 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-93928 Authentication Bypass Using an Alternate Path or Channel vulnerability in Magepe... |
high | 7.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-9231 The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for W... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-94117 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95271 A vulnerability has been found in dgtlmoon changedetection.io up to 0.60.7. |
high | 7.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95499 A flaw has been found in JosephChuks php-file-manager-with-code-editor up to 3.0... |
high | 7.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95500 A vulnerability has been found in JosephChuks php-file-manager-with-code-editor... |
high | 7.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95656 A vulnerability was found in dgtlmoon changedetection.io up to 50389b07. |
high | 7.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-87153 Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (comp... |
high | 8.1 | — | Oracle / product hub | 2026-09-15 | 2026-09-22 |
| CVE-2026-87154 Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (comp... |
high | 8.1 | — | Oracle / product hub | 2026-09-15 | 2026-09-22 |
| CVE-2026-87155 Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (comp... |
high | 8.8 | — | Oracle / product hub | 2026-09-15 | 2026-09-22 |
| CVE-2026-87156 Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (comp... |
high | 7.1 | — | Oracle / product hub | 2026-09-15 | 2026-09-22 |
| CVE-2026-87163 Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (compo... |
high | 8.8 | — | Oracle / purchasing | 2026-09-15 | 2026-09-22 |
| CVE-2026-87166 Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (compo... |
high | 8.1 | — | Oracle / purchasing | 2026-09-15 | 2026-09-22 |
| CVE-2026-87167 Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (compo... |
high | 8.1 | — | Oracle / purchasing | 2026-09-15 | 2026-09-22 |
| CVE-2026-87168 Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (compo... |
high | 8.1 | — | Oracle / purchasing | 2026-09-15 | 2026-09-22 |
| CVE-2026-25294 Transient DOS while parsing frame during channel usage. |
high | 7.4 | — | Qualcomm / cologne firmware | 2026-09-17 | 2026-09-22 |
| CVE-2026-25290 Memory Corruption when validating large data buffers from external sources using... |
high | 7.8 | — | Qualcomm / cologne firmware | 2026-09-17 | 2026-09-22 |
| CVE-2026-25284 Information Disclosure when a pointer is reused after being deallocated. |
high | 7.3 | — | Qualcomm / cologne firmware | 2026-09-17 | 2026-09-22 |
| CVE-2026-25283 Memory Corruption when copying unverified data from an external source exceeds t... |
high | 8.8 | — | Qualcomm / cologne firmware | 2026-09-17 | 2026-09-22 |
| CVE-2026-25282 Transient DOS when processing unverified data from a neighboring system causes o... |
high | 7.9 | — | Qualcomm / cologne firmware | 2026-09-17 | 2026-09-22 |
| CVE-2026-25281 Transient DOS when processing large or numerous request buffers without sufficie... |
high | 7.4 | — | Qualcomm / cologne firmware | 2026-09-17 | 2026-09-22 |
| CVE-2026-25280 Memory corruption when processing escape handling flow with insufficient user bu... |
high | 7.8 | — | Qualcomm / wsa8845h firmware | 2026-09-17 | 2026-09-22 |
| CVE-2026-87265 Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (compo... |
high | 8.1 | — | Oracle / purchasing | 2026-09-15 | 2026-09-22 |
| CVE-2026-64195 There is an out-of-bounds write vulnerability in DASYLab due to lack of proper v... |
high | 7.3 | — | Ni / dasylab | 2026-09-03 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.