September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-93468 The OAKlouds developed by HGiga has an Arbitrary File Read vulnerability. |
high | 7.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-19515 The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate... |
high | 7.0 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-81902 Concrete CMS 9 through 9.5.2 did not validate a CSRF token in the orphaned block... |
high | 8.1 | — | Concretecms / concrete cms | 2026-09-14 | 2026-09-18 |
| CVE-2026-19781 Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer Overflow Remote Code Exec... |
high | 7.8 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-19774 BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. |
high | 7.1 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-85128 The Choose User Role at Registration WordPress plugin before 1.3.3 does not vali... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-85130 The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value su... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-87786 The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinat... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-88792 The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitis... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-88904 The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-91014 The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2... |
high | 7.1 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-86801 The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-81810 The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not pe... |
high | 7.2 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-85122 The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not vali... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-85127 The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does no... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-87767 The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does... |
high | 8.6 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-87770 The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sani... |
high | 8.6 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-87771 The Product Question and Answer WordPress plugin through 1.1.0 does not sanitize... |
high | 8.6 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-87774 The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize an... |
high | 8.6 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-87775 The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize an... |
high | 8.6 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-88825 The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-90978 The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on se... |
high | 7.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-25687 A race condition in the ZPA tunnel handler of affected versions of Zscaler Clien... |
high | 8.1 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-59569 An improper input validation vulnerability in Zscaler Client Connector on Androi... |
high | 8.1 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-59570 On affected versions of Zscaler client connector, a pre-installed peer app can t... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-92903 Improper input validation in Snowflake CLI versions prior to 3.27.0 allowed unsa... |
high | 8.2 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-28326 SolarWinds Access Rights Manager was reported to be affected by an unauthenticat... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-40530 An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in... |
high | 8.0 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-40539 An improper certificate validation vulnerability in Email API in Synology DiskSt... |
high | 7.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-85469 A flaw was found in quay-builder-qemu. |
high | 8.0 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-86520 Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read ac... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-69513 Heap-based buffer overflow in Windows Error Reporting allows an authorized attac... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-18 |
| CVE-2026-86427 LibreNMS before 26.8.0 contains an argument injection vulnerability in the graph... |
high | 8.8 | — | Librenms / librenms | 2026-09-07 | 2026-09-18 |
| CVE-2026-93597 ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in th... |
high | 7.7 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-92399 A vulnerability was determined in GPAC 26.07.0. |
high | 7.3 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-19499 Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can writ... |
high | 7.7 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-10030 IBM MQ Console allows authenticated non-administrative users to create and start... |
high | 7.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-88865 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate... |
high | 8.1 | — | — | 2026-09-10 | 2026-09-18 |
| CVE-2026-88870 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a c... |
high | 7.1 | — | — | 2026-09-10 | 2026-09-18 |
| CVE-2026-87814 SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the... |
high | 7.3 | — | — | 2026-09-09 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.