September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-72958 Double free in Windows Credential Guard allows an authorized attacker to elevate... |
high | 8.2 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-21 |
| CVE-2026-72989 Use of uninitialized resource in Windows Failover Cluster allows an unauthorized... |
high | 7.5 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-21 |
| CVE-2026-72961 Out-of-bounds read in Windows Hyper-V allows an authorized attacker to elevate p... |
high | 8.2 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-21 |
| CVE-2026-93375 Incorrect reference resolution in Tracing in Google Chrome on on Windows prior t... |
high | 8.1 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-93997 A weakness has been identified in SourceCodester Drug Recommendation System 1.0. |
high | 7.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94039 A vulnerability was detected in vas3k TaxHacker up to 0.8.5. |
high | 7.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94044 A vulnerability was identified in 03-lovepreetSingh MCP up to f95d035c5317fad81a... |
high | 7.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-83052 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware... |
high | 7.6 | — | Oracle / webcenter portal | 2026-09-15 | 2026-09-21 |
| CVE-2026-83411 Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (compo... |
high | 8.8 | — | Oracle / coherence | 2026-09-15 | 2026-09-21 |
| CVE-2026-87233 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 7.6 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-87243 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 8.0 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-87242 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 7.4 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-87241 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 8.1 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-87236 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 7.1 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-87235 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 7.4 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-69617 Out-of-bounds read in Windows Resilient File System (ReFS) allows an authorized... |
high | 7.0 | — | Microsoft / windows 11 26h1 | 2026-09-08 | 2026-09-21 |
| CVE-2026-87234 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 8.1 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-93381 Buffer overflow in PDFium in Google Chrome on on Windows prior to 153.0.8010.52... |
high | 8.8 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-83549 SonicWall SMA1000 Appliances OS Command Injection Vulnerability |
high | 7.8 | Listed | SonicWall / SMA1000 Appliances | 2026-09-01 | 2026-09-21 |
| CVE-2026-87976 Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when... |
high | 8.1 | — | Apache / nifi | 2026-09-16 | 2026-09-21 |
| CVE-2026-86089 Apache NiFi 2.11.0 supports migrating the contents of a version-controlled Proce... |
high | 7.1 | — | Apache / nifi | 2026-09-16 | 2026-09-21 |
| CVE-2026-87250 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 7.6 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-70469 Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the appli... |
high | 7.5 | — | Apache / nifi | 2026-09-16 | 2026-09-21 |
| CVE-2026-87249 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 7.1 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-76554 The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that th... |
high | 7.2 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-76790 The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise a... |
high | 7.1 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-85574 The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any au... |
high | 8.0 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-85680 The Ultimate Member WordPress plugin before 2.13.1 does not escape a value deriv... |
high | 8.8 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-86814 The UsersWP WordPress plugin before 1.5.10 does not verify that a social login p... |
high | 8.1 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-88824 The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on o... |
high | 8.8 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-88926 The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4... |
high | 8.6 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-92404 The MgoSync WordPress plugin before 2.1.7 does not have authorization controls o... |
high | 7.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-81650 The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not... |
high | 7.2 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-82842 The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the config... |
high | 8.1 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-85017 The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not per... |
high | 7.5 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-87067 The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which cl... |
high | 8.5 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-87839 The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, an... |
high | 7.5 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-92540 The Import and export users and customers WordPress plugin before 2.5.2 does not... |
high | 7.2 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-92541 The Import and export users and customers WordPress plugin before 2.5.2 does not... |
high | 7.2 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-93031 The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-B... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.