September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-88031 Improper neutralization of special elements in data query logic in the GridFS co... |
high | 8.1 | — | Mongodb / go driver | 2026-09-10 | 2026-09-29 |
| CVE-2026-88022 Improper neutralization of special elements in data query logic in the MongoDB i... |
high | 7.7 | — | Mongodb / laravel mongodb | 2026-09-10 | 2026-09-29 |
| CVE-2026-88023 Improper neutralization of special elements in data query logic in the GridFS co... |
high | 8.3 | — | Mongodb / php library | 2026-09-10 | 2026-09-29 |
| CVE-2026-88024 Improper neutralization of special elements in data query logic in the GridFS co... |
high | 8.3 | — | Mongodb / rust driver | 2026-09-10 | 2026-09-29 |
| CVE-2026-88025 Improper neutralization of special elements in data query logic in the GridFS co... |
high | 8.3 | — | Mongodb / c\# driver | 2026-09-10 | 2026-09-29 |
| CVE-2026-88045 rclone is a command-line program to sync files and directories to and from diffe... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88047 Tesseract is an open source OCR engine. |
high | 7.8 | — | Tesseract-ocr / tesseract ocr | 2026-09-10 | 2026-09-14 |
| CVE-2026-88048 Tesseract is an open source OCR engine. |
high | 7.1 | — | Tesseract-ocr / tesseract ocr | 2026-09-10 | 2026-09-14 |
| CVE-2026-73699 FileRun before 2026.3.0 contains a PHP object injection vulnerability that allow... |
high | 7.2 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-73693 FileRun before 2026.3.0 contains an OS command injection vulnerability in the Ph... |
high | 8.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-73694 FileRun before 2026.3.0 contains an OS command injection vulnerability caused by... |
high | 7.2 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-73698 FileRun before 2026.3.0 contains a SQL injection vulnerability that allows deleg... |
high | 7.2 | — | — | 2026-09-10 | 2026-09-15 |
| CVE-2026-88937 knowns through 0.33.0 fails to properly validate template destination paths in t... |
high | 8.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88939 knowns through 0.33.0 exempts the project.set action from permission guard check... |
high | 8.3 | — | — | 2026-09-10 | 2026-09-15 |
| CVE-2026-88959 Anchor CMS through 0.12.7 fails to enforce role-based access control in admin us... |
high | 8.8 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-88016 rclone is a command-line program to sync files and directories to and from diffe... |
high | 7.1 | — | Rclone / rclone | 2026-09-10 | 2026-09-15 |
| CVE-2026-88017 rclone is a command-line program to sync files and directories to and from diffe... |
high | 7.3 | — | Rclone / rclone | 2026-09-10 | 2026-09-14 |
| CVE-2026-88009 Traefik is an open source HTTP reverse proxy and load balancer. |
high | 8.2 | — | Traefik / traefik | 2026-09-10 | 2026-09-14 |
| CVE-2026-88011 Traefik is an open source HTTP reverse proxy and load balancer. |
high | 8.1 | — | Traefik / traefik | 2026-09-10 | 2026-09-15 |
| CVE-2026-81468 Dell ThinOS 10, versions prior to 2605_10. |
high | 7.2 | — | Dell / thinos | 2026-09-10 | 2026-09-16 |
| CVE-2026-81048 Dell ThinOS 10, versions prior to 2605_10.2616, contain an Improper Neutralizati... |
high | 8.8 | — | Dell / thinos | 2026-09-10 | 2026-09-16 |
| CVE-2026-79987 A remote, authenticated, non-admin Craft CMS Control Panel user with only the ac... |
high | 8.8 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-4129 There is an improper access control vulnerability in NI SystemLink that may allo... |
high | 8.1 | — | — | 2026-09-10 | 2026-09-16 |
| CVE-2026-4130 There is a storage of sensitive information in cleartext vulnerability in NI Sys... |
high | 7.1 | — | — | 2026-09-10 | 2026-09-16 |
| CVE-2026-88924 A flaw was found in the admin backend of gvfs. |
high | 7.0 | — | — | 2026-09-10 | 2026-10-21 |
| CVE-2026-88004 Traefik is an open source HTTP reverse proxy and load balancer. |
high | 7.4 | — | Traefik / traefik | 2026-09-10 | 2026-09-14 |
| CVE-2026-84821 Unauthenticated Broken Access Control in WP Fast Total Search <= 1.82.284 versio... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-84816 Unauthenticated Cross Site Scripting (XSS) in WPCS <= 1.3.2 versions. |
high | 7.1 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-84819 Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.3 versions. |
high | 7.1 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-81796 Authentication Bypass Using an Alternate Path or Channel vulnerability in WEN So... |
high | 7.3 | — | — | 2026-09-10 | 2026-09-21 |
| CVE-2026-81799 Unauthenticated Broken Access Control in Return Refund and Exchange For WooComme... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-81801 Subscriber Settings Change in WP-Stateless <= 4.4.1 versions. |
high | 8.1 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-81803 Subscriber Remote Code Execution (RCE) in RepairBuddy <= 4.1224 versions. |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-81804 Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore & Migratio... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-81805 Unauthenticated Privilege Escalation in SiteSkite <= 2.1.5 versions. |
high | 8.1 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-81794 Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-81795 Unauthenticated Cross Site Scripting (XSS) in Page Visits Counter – Lite <= 1.2.... |
high | 7.1 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-81786 Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommer... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-81789 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 8.6 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-81783 Subscriber Broken Authentication in MailMunch – Grow your Email List <= 3.2.5 ve... |
high | 7.1 | — | — | 2026-09-10 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.