September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-90768 CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpo... |
high | 8.1 | — | — | 2026-09-13 | 2026-09-23 |
| CVE-2026-90769 Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sou... |
high | 7.7 | — | — | 2026-09-13 | 2026-09-24 |
| CVE-2026-90770 Spug through 3.4.0 contains a remote code execution vulnerability in the ping_ch... |
high | 8.8 | — | — | 2026-09-13 | 2026-09-23 |
| CVE-2026-90772 Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptio... |
high | 7.6 | — | — | 2026-09-13 | 2026-09-24 |
| CVE-2026-90514 A vulnerability has been found in SourceCodester School Registration and Fee Sys... |
high | 7.3 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90561 Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-... |
high | 8.7 | — | — | 2026-09-13 | 2026-09-24 |
| CVE-2026-90562 LangBot before 4.10.11 generates password recovery keys with only 24 bits of ent... |
high | 8.1 | — | — | 2026-09-13 | 2026-09-23 |
| CVE-2026-90510 A security vulnerability has been detected in dromara orion-visor up to 2.5.7. |
high | 8.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90509 A weakness has been identified in dromara orion-visor up to 2.5.7. |
high | 7.3 | — | — | 2026-09-13 | 2026-09-20 |
| CVE-2026-90504 A vulnerability has been found in vvbbnn00 WARP-Clash-API up to c7bf236007395986... |
high | 7.3 | — | — | 2026-09-13 | 2026-09-21 |
| CVE-2026-90498 A vulnerability was identified in lenve vhr 1.0-SNAPSHOT. |
high | 7.3 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-86406 The User Registration & Membership WordPress plugin before 5.2.8 does not check... |
high | 7.5 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-89080 The Really Simple Security WordPress plugin before 9.8.1 does not prevent an una... |
high | 7.5 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-80071 The User Registration & Membership WordPress plugin before 5.2.8 does not proper... |
high | 7.2 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90678 An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3... |
high | 7.5 | — | — | 2026-09-13 | 2026-09-22 |
| CVE-2026-90495 A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. |
high | 7.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90493 A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build... |
high | 8.8 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90668 The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the... |
high | 7.5 | — | — | 2026-09-13 | 2026-09-22 |
| CVE-2026-90651 Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0... |
high | 8.1 | — | — | 2026-09-13 | 2026-09-22 |
| CVE-2026-90647 ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows con... |
high | 7.4 | — | — | 2026-09-12 | 2026-09-22 |
| CVE-2026-90616 In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read an... |
high | 7.4 | — | — | 2026-09-12 | 2026-09-22 |
| CVE-2026-90556 Freeciv versions before 3.2.6 contain a heap buffer overflow in worklist_load()... |
high | 7.8 | — | — | 2026-09-12 | 2026-09-23 |
| CVE-2026-90559 snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Sn... |
high | 7.5 | — | — | 2026-09-12 | 2026-10-08 |
| CVE-2026-90560 zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerabi... |
high | 8.2 | — | — | 2026-09-12 | 2026-09-24 |
| CVE-2026-90554 vLLM versions >=0.10.2 and <0.28.0 do not apply any audio decode-size or duratio... |
high | 7.5 | — | Vllm / vllm | 2026-09-12 | 2026-09-24 |
| CVE-2026-90553 vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOn... |
high | 7.8 | — | Vllm / vllm | 2026-09-12 | 2026-09-16 |
| CVE-2026-90535 Flowise versions before 3.1.4 contain an unauthenticated denial of service vulne... |
high | 7.5 | — | Flowiseai / flowise | 2026-09-12 | 2026-09-15 |
| CVE-2026-90537 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a m... |
high | 8.2 | — | — | 2026-09-12 | 2026-09-15 |
| CVE-2026-15451 The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privile... |
high | 8.8 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-78175 The Tutor LMS – eLearning and online course solution plugin for WordPress is vul... |
high | 8.8 | — | — | 2026-09-12 | 2026-09-15 |
| CVE-2026-85200 The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all... |
high | 7.5 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-16482 The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulner... |
high | 7.5 | — | — | 2026-09-12 | 2026-09-15 |
| CVE-2026-84099 The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthen... |
high | 8.1 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-87759 The Add User Autocomplete WordPress plugin before 1.2 does not perform any capab... |
high | 8.8 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-87842 The Zonify WordPress plugin before 1.0.5 does not perform any capability or auth... |
high | 7.5 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-87888 The YayPricing WordPress plugin before 3.5.7 does not perform an authorization c... |
high | 8.0 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-84047 The Album Cover Finder WordPress plugin through 0.7.0 does not properly sanitize... |
high | 8.6 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-77752 The Temporary Login Without Password WordPress plugin before 1.9.9 does not veri... |
high | 7.2 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-80491 The SAMO Forms WordPress plugin through 1.0.0 does not properly sanitise and esc... |
high | 8.6 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-80494 The Yogeta WP Cloud WordPress plugin through 1.0 does not validate a user-suppli... |
high | 8.6 | — | — | 2026-09-12 | 2026-09-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.