September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-57866 Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. |
high | 8.8 | — | Apache / impala | 2026-09-09 | 2026-09-10 |
| CVE-2026-87794 bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in... |
high | 8.4 | — | — | 2026-09-09 | 2026-09-18 |
| CVE-2026-87795 zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters... |
high | 8.2 | — | — | 2026-09-09 | 2026-09-14 |
| CVE-2026-80099 Several Newfold plugins are vulnerable to Authentication Bypass. |
high | 8.8 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-80122 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.3 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-87766 A flaw was found in bubblewrap. |
high | 8.8 | — | — | 2026-09-09 | 2026-10-20 |
| CVE-2026-14359 The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Priv... |
high | 8.8 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-14989 The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is... |
high | 7.2 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-78491 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 8.2 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-14 |
| CVE-2026-78494 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.4 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-11 |
| CVE-2026-79636 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.0 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-80123 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.5 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-75927 The PublishPress Capabilities – User Role Editor, Access Permissions, User Capab... |
high | 7.2 | — | — | 2026-09-09 | 2026-09-11 |
| CVE-2026-83593 The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for... |
high | 7.2 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-84068 The Quentn WP WordPress plugin before 1.2.15 does not adequately escape a reques... |
high | 8.6 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-76009 The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable... |
high | 8.1 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-14962 The ELEX WooCommerce Request a Quote WordPress plugin before 2.4.1 does not prop... |
high | 8.6 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-16960 The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public tem... |
high | 7.5 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-87734 An issue was discovered in the utcp package before 0.0.6 for OCaml. |
high | 7.5 | — | — | 2026-09-09 | 2026-09-14 |
| CVE-2026-21100 Improper access control in SystemUI prior to SMR Sep-2026 Release 1 allows local... |
high | 7.1 | — | Samsung / android | 2026-09-09 | 2026-09-10 |
| CVE-2026-21090 Out-of-bounds write in libsaviextractor.so prior to SMR Sep-2026 Release 1 allow... |
high | 7.8 | — | Samsung / android | 2026-09-09 | 2026-09-11 |
| CVE-2026-21091 Out-of-bounds write in libcodec2secevrcdec.so prior to SMR Sep-2026 Release 1 al... |
high | 7.8 | — | Samsung / android | 2026-09-09 | 2026-09-11 |
| CVE-2026-21094 Improper input validation in wpa_supplicant prior to SMR Sep-2026 Release 1 allo... |
high | 8.8 | — | Samsung / android | 2026-09-09 | 2026-09-11 |
| CVE-2026-21086 Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows lo... |
high | 7.8 | — | Samsung / android | 2026-09-09 | 2026-09-28 |
| CVE-2026-21087 Out-of-bounds write in libmdnie.so prior to SMR Sep-2026 Release 1 allows local... |
high | 7.8 | — | Samsung / android | 2026-09-09 | 2026-09-11 |
| CVE-2026-21088 Improper input validation in loading a subtitle frame in libsubextractor.so prio... |
high | 7.8 | — | Samsung / android | 2026-09-09 | 2026-09-10 |
| CVE-2026-21089 Improper input validation in removing style tag in libsubextractor.so prior to S... |
high | 7.8 | — | Samsung / android | 2026-09-09 | 2026-09-10 |
| CVE-2026-84293 The Repeater Fields for Gravity Forms plugin for WordPress is vulnerable to Stor... |
high | 7.2 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-6485 UEFI BIOS embedded Shell could be used to bypass Secure Boot via shell commands... |
high | 8.2 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-49314 OOB write vulnerability in the rendering and composition module. |
high | 7.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-49315 DoS vulnerability in the input device module. |
high | 7.1 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-49310 Permission control vulnerability in the event notification module. |
high | 8.6 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-12855 Unvalidated memory boundary could result in arbitrary code execution. |
high | 8.2 | — | — | 2026-09-09 | 2026-10-01 |
| CVE-2026-17553 The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in ve... |
high | 7.2 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-87084 Tanium addressed a server-side request forgery vulnerability in Enforce. |
high | 7.7 | — | Tanium / enforce | 2026-09-09 | 2026-09-16 |
| CVE-2026-87088 Tanium addressed an unauthorized code execution vulnerability in Enforce. |
high | 7.0 | — | Tanium / enforce | 2026-09-09 | 2026-09-16 |
| CVE-2026-87036 Tanium addressed an improper access controls vulnerability in Comply. |
high | 8.1 | — | Tanium / comply | 2026-09-09 | 2026-09-16 |
| CVE-2026-87072 Tanium addressed an improper access controls vulnerability in Comply. |
high | 7.1 | — | Tanium / comply | 2026-09-09 | 2026-09-16 |
| CVE-2026-87075 Tanium addressed an improper access controls vulnerability in Comply. |
high | 8.1 | — | Tanium / comply | 2026-09-09 | 2026-09-16 |
| CVE-2026-87021 Tanium addressed an unauthorized code execution vulnerability in Comply. |
high | 7.2 | — | Tanium / comply | 2026-09-09 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.