September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87209 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 7.1 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-87210 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 8.3 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-87240 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 7.0 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-87211 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 7.5 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-87212 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 7.4 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-81796 Authentication Bypass Using an Alternate Path or Channel vulnerability in WEN So... |
high | 7.3 | — | — | 2026-09-10 | 2026-09-21 |
| CVE-2026-83242 Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience... |
high | 7.3 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83284 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
high | 8.6 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-87159 Vulnerability in the Oracle HRMS (India) product of Oracle E-Business Suite (com... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-87963 The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize... |
high | 8.6 | — | — | 2026-09-17 | 2026-09-20 |
| CVE-2026-91935 Flowise before 3.1.4 fails to validate baseURL parameters in chat-model nodes, a... |
high | 8.3 | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-91941 Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerabilit... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-90509 A weakness has been identified in dromara orion-visor up to 2.5.7. |
high | 7.3 | — | — | 2026-09-13 | 2026-09-20 |
| CVE-2026-90515 A vulnerability was determined in SourceCodester School Registration and Fee Sys... |
high | 7.3 | — | — | 2026-09-13 | 2026-09-20 |
| CVE-2026-87824 zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.t... |
high | 7.5 | — | — | 2026-09-09 | 2026-09-20 |
| CVE-2026-86754 Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client man... |
high | 7.3 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-20 |
| CVE-2026-86759 Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endp... |
high | 7.1 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-20 |
| CVE-2026-13327 Improper certificate validation on LDAPS connections to Active Directory in Devo... |
high | 8.3 | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-12101 IBM Verify Identity Access could allow an administrator to execute additional co... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-87935 The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload i... |
high | 8.1 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-86721 AVideo through commit c3edcc274c contains an authorization bypass vulnerability... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-19 |
| CVE-2026-85410 The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder,... |
high | 8.1 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-84398 CM2507 IP cameras accept an empty password for a privileged account exposed thro... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-82536 Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability in the she... |
high | 8.8 | — | — | 2026-09-08 | 2026-09-19 |
| CVE-2026-66626 Editor SQL Injection in SKT Addons for Elementor <= 4.0 versions. |
high | 7.6 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-56795 Dell Server Update Utility, versions prior to 26.07.01, contains an Uncontrolled... |
high | 8.2 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-12954 The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Wr... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-15275 The WP Multi Store Locator Pro plugin for WordPress is vulnerable to generic SQL... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-18442 The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPr... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-93382 Use after free in PDFium in Google Chrome prior to 153.0.8010.52 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-09-17 | 2026-09-19 |
| CVE-2026-83318 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-19 |
| CVE-2026-83315 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-19 |
| CVE-2026-53266 Linux Kernel Out-of-Bounds Write Vulnerability |
high | 8.8 | Listed | Linux / Kernel | 2026-06-25 | 2026-09-19 |
| CVE-2026-15815 Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when
ex... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-11381 IBM MQ could allow an authenticated attacker to cause a denial of service or pot... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-10744 IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attac... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-92917 Grav is a flat-file CMS. |
high | 7.5 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-66619 Administrator SQL Injection in Newsletters <= 4.18 versions. |
high | 7.6 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-66630 Administrator SQL Injection in PublishPress Series <= 3.1.3 versions. |
high | 7.6 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-93591 SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph... |
high | 7.6 | — | — | 2026-09-18 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.