September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-66624 Administrator SQL Injection in WPMasterToolKit <= 2.22.0 versions. |
high | 7.6 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-66625 Administrator SQL Injection in WC Vendors Marketplace <= 2.7.2.1 versions. |
high | 7.6 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-66628 Shop manager SQL Injection in WP-Lister Lite for eBay <= 3.8.11 versions. |
high | 7.6 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-66631 Administrator SQL Injection in MC Woocommerce Wishlist <= 1.9.21 versions. |
high | 7.6 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-78295 Unauthenticated Cross Site Request Forgery (CSRF) in Xagio SEO <= 7.1.0.43 versi... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-90887 Unauthenticated Cross Site Scripting (XSS) in WP Inventory Manager <= 2.5.4 vers... |
high | 7.1 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-90986 Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statisti... |
high | 7.1 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92926 A vulnerability has been found in code-projects Matrimonial System 1.0. |
high | 7.3 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92986 SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree wi... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92087 @fastify/auth is a Fastify plugin that composes multiple authentication and auth... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-91933 Flowise before 3.1.4 fails to enforce workspace-level authorization checks in op... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-91938 Flowise versions before 3.1.4 contain a server-side request forgery vulnerabilit... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-81956 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81957 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81959 Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta... |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81960 Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta... |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81949 Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized... |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81950 Double free in Microsoft Office Excel allows an unauthorized attacker to execute... |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81951 Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta... |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81952 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81953 Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized att... |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81954 Use after free in Microsoft Office Excel allows an unauthorized attacker to exec... |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81947 Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta... |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81948 Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta... |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81397 Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta... |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81398 Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta... |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81388 Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized att... |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81389 Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta... |
high | 7.0 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-81386 Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta... |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-80085 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-80080 Double free in Microsoft Office Word allows an unauthorized attacker to execute... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-78525 Use after free in Microsoft Office Outlook allows an unauthorized attacker to ex... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-78526 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-78514 Use after free in Microsoft Office Word allows an unauthorized attacker to execu... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-78517 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-78518 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-78521 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-78507 Use after free in Microsoft Office Word allows an unauthorized attacker to execu... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-78511 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
| CVE-2026-78504 Stack-based buffer overflow in Microsoft Office Word allows an unauthorized atta... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.