September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-81090 The Gpx2Graphics WordPress plugin through 0.3 does not perform a CSRF check when... |
high | 7.2 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-81429 The Export & Import WPBakery Page Builder WordPress plugin through 1.0.2 does no... |
high | 7.1 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-81742 The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any author... |
high | 8.8 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-77705 The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10... |
high | 7.2 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-89266 stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where... |
high | 8.2 | — | — | 2026-09-12 | 2026-09-24 |
| CVE-2026-90456 An example environment-configuration file for a bundled inventory-management com... |
high | 8.1 | — | — | 2026-09-11 | 2026-10-02 |
| CVE-2026-90444 A file-transfer interface that requires valid credentials accepts attacker-contr... |
high | 8.8 | — | — | 2026-09-11 | 2026-10-02 |
| CVE-2026-54240 libde265 is an open source implementation of the h.265 video codec. |
high | 7.4 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-54241 libde265 is an open source implementation of the h.265 video codec. |
high | 7.4 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-49846 libks provides foundational support for signalwire C products. |
high | 7.5 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-50013 Hoverfly is an open source API simulation tool. |
high | 7.5 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-81907 Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF)... |
high | 7.1 | — | Concretecms / concrete cms | 2026-09-11 | 2026-09-24 |
| CVE-2026-54166 Shelf is a platform for tracking physical assets. |
high | 7.1 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-54174 melange allows users to build apk packages using declarative pipelines. |
high | 8.3 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-49464 NL Portal Backend Libraries provide backend components for Dutch government port... |
high | 8.1 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-89769 In the Linux kernel, the following vulnerability has been resolved:
clocksource... |
high | 7.4 | — | — | 2026-09-11 | 2026-10-19 |
| CVE-2026-89771 In the Linux kernel, the following vulnerability has been resolved:
ring-buffer... |
high | 7.8 | — | — | 2026-09-11 | 2026-10-19 |
| CVE-2026-89760 In the Linux kernel, the following vulnerability has been resolved:
mm, swap: d... |
high | 7.8 | — | — | 2026-09-11 | 2026-10-19 |
| CVE-2026-89761 In the Linux kernel, the following vulnerability has been resolved:
apparmor: f... |
high | 7.8 | — | — | 2026-09-11 | 2026-10-21 |
| CVE-2026-89762 In the Linux kernel, the following vulnerability has been resolved:
apparmor: f... |
high | 7.8 | — | — | 2026-09-11 | 2026-10-21 |
| CVE-2026-89763 In the Linux kernel, the following vulnerability has been resolved:
KEYS: trust... |
high | 7.8 | — | — | 2026-09-11 | 2026-10-21 |
| CVE-2026-89764 In the Linux kernel, the following vulnerability has been resolved:
rust: devre... |
high | 7.8 | — | — | 2026-09-11 | 2026-10-19 |
| CVE-2026-89767 In the Linux kernel, the following vulnerability has been resolved:
ovl: fix do... |
high | 7.8 | — | — | 2026-09-11 | 2026-10-19 |
| CVE-2026-89754 In the Linux kernel, the following vulnerability has been resolved:
mm/pagewalk... |
high | 7.8 | — | — | 2026-09-11 | 2026-10-19 |
| CVE-2026-89755 In the Linux kernel, the following vulnerability has been resolved:
mm/migrate_... |
high | 7.8 | — | — | 2026-09-11 | 2026-10-21 |
| CVE-2026-89758 In the Linux kernel, the following vulnerability has been resolved:
mm/mempolic... |
high | 7.8 | — | — | 2026-09-11 | 2026-10-19 |
| CVE-2026-89744 In the Linux kernel, the following vulnerability has been resolved:
device prop... |
high | 8.4 | — | — | 2026-09-11 | 2026-10-19 |
| CVE-2026-89746 In the Linux kernel, the following vulnerability has been resolved:
tracing: Fi... |
high | 7.8 | — | — | 2026-09-11 | 2026-10-19 |
| CVE-2026-89747 In the Linux kernel, the following vulnerability has been resolved:
tracing: Fi... |
high | 7.8 | — | — | 2026-09-11 | 2026-10-19 |
| CVE-2026-89748 In the Linux kernel, the following vulnerability has been resolved:
tracing: Fi... |
high | 7.8 | — | — | 2026-09-11 | 2026-10-19 |
| CVE-2026-89750 In the Linux kernel, the following vulnerability has been resolved:
tracing/use... |
high | 7.8 | — | — | 2026-09-11 | 2026-10-19 |
| CVE-2026-89736 In the Linux kernel, the following vulnerability has been resolved:
usb: gadget... |
high | 7.8 | — | — | 2026-09-11 | 2026-10-19 |
| CVE-2026-89738 In the Linux kernel, the following vulnerability has been resolved:
usb: gadget... |
high | 7.8 | — | — | 2026-09-11 | 2026-10-21 |
| CVE-2026-89741 In the Linux kernel, the following vulnerability has been resolved:
Revert "med... |
high | 7.8 | — | — | 2026-09-11 | 2026-10-19 |
| CVE-2026-89742 In the Linux kernel, the following vulnerability has been resolved:
rapidio: mp... |
high | 7.8 | — | — | 2026-09-11 | 2026-10-19 |
| CVE-2026-89743 In the Linux kernel, the following vulnerability has been resolved:
misc: nsm:... |
high | 7.7 | — | — | 2026-09-11 | 2026-10-19 |
| CVE-2026-89729 In the Linux kernel, the following vulnerability has been resolved:
HID: sensor... |
high | 8.8 | — | — | 2026-09-11 | 2026-10-19 |
| CVE-2026-89731 In the Linux kernel, the following vulnerability has been resolved:
cxl/ras: Fi... |
high | 7.1 | — | — | 2026-09-11 | 2026-10-19 |
| CVE-2026-89733 In the Linux kernel, the following vulnerability has been resolved:
usb: gadget... |
high | 7.8 | — | — | 2026-09-11 | 2026-10-19 |
| CVE-2026-89724 In the Linux kernel, the following vulnerability has been resolved:
media: vico... |
high | 7.8 | — | — | 2026-09-11 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.