September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-88289 GeoVision GV-LPC2211 V1.14 (260903) fails to validate attacker-controlled variab... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88290 GeoVision GV-LPC2211 V1.14 (260903) allows unauthenticated clients to declare un... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88282 GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username conta... |
high | 7.2 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88286 GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88287 GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthe... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88271 GeoVision GV-LPC2211 V1.13 allows a Guest user to overwrite device configuration... |
high | 8.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88272 GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containin... |
high | 7.2 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88273 GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to... |
high | 7.2 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88274 GeoVision GV-LPC2211 V1.13 allows an administrator-controlled wireless SSID cont... |
high | 7.2 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88275 GeoVision GV-LPC2211 V1.13 allows an administrator-controlled WPA-PSK containing... |
high | 7.2 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88276 GeoVision GV-LPC2211 V1.13 allows administrator-controlled WEP key values contai... |
high | 7.2 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88277 GeoVision GV-LPC2211 V1.13 allows an authenticated ONVIF user to inject shell co... |
high | 8.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-84042 A flaw was found in crun. |
high | 7.8 | — | — | 2026-09-10 | 2026-09-15 |
| CVE-2026-42805 A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI385... |
high | 8.4 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-42807 A heap-based buffer overflow vulnerability in the PC bridge protocol decoder of... |
high | 8.0 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-42804 A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360... |
high | 7.6 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-80354 Authorization bypass through User-Controlled key vulnerability in Apache Camel K... |
high | 8.1 | — | Apache / camel | 2026-09-10 | 2026-09-14 |
| CVE-2026-77771 The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugi... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-81431 The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not val... |
high | 7.2 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-82925 The Site Reviews WordPress plugin before 8.3.0 does not prevent request data fro... |
high | 8.1 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-19436 The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-19439 The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-82079 A stack-based buffer overflow vulnerability in the Nintendo Switch local wireles... |
high | 8.4 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-49363 An unauthenticated remote attacker connecting with the CORE protocol can discove... |
high | 7.5 | — | Apache / artemis | 2026-09-10 | 2026-09-16 |
| CVE-2026-49362 An unauthenticated remote attacker can create arbitrary durable queues via the C... |
high | 7.5 | — | Apache / artemis | 2026-09-10 | 2026-09-16 |
| CVE-2026-76562 The Sidebar Manager Light plugin for WordPress is vulnerable to Stored Cross-Sit... |
high | 7.2 | — | — | 2026-09-10 | 2026-09-28 |
| CVE-2026-14873 The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalati... |
high | 8.0 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-15019 The Direct Download for WooCommerce plugin for WordPress is vulnerable to Direct... |
high | 7.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-19584 Velociraptor allows for the creation of notebook backups in its default enabled... |
high | 7.7 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-87933 A vulnerability was found in DaveGamble cJSON up to 1.7.19. |
high | 7.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-87925 A vulnerability was detected in Rizwan17 inventory-management-system up to bfe78... |
high | 7.3 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-71809 Authentication Bypass via Hardcoded Master Verification Code vulnerability in Si... |
high | 8.1 | — | — | 2026-09-09 | 2026-09-14 |
| CVE-2026-87998 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
high | 7.1 | — | Openwebui / open webui | 2026-09-09 | 2026-09-16 |
| CVE-2026-87999 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
high | 7.1 | — | Openwebui / open webui | 2026-09-09 | 2026-09-16 |
| CVE-2026-87921 A vulnerability was identified in Rizwan17 inventory-management-system up to bfe... |
high | 7.3 | — | — | 2026-09-09 | 2026-09-14 |
| CVE-2026-87922 A security flaw has been discovered in Rizwan17 inventory-management-system up t... |
high | 7.3 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-87995 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
high | 8.7 | — | Openwebui / open webui | 2026-09-09 | 2026-09-16 |
| CVE-2026-87996 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
high | 7.7 | — | Openwebui / open webui | 2026-09-09 | 2026-09-16 |
| CVE-2026-87016 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
high | 8.1 | — | Openwebui / open webui | 2026-09-09 | 2026-09-15 |
| CVE-2026-15913 In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteF... |
high | 7.7 | — | — | 2026-09-09 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.