September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-74860 A flaw was found in libxml2 with Python bindings enabled. |
high | 8.5 | — | — | 2026-09-08 | 2026-10-30 |
| CVE-2026-3174 The Event Tickets and Registration plugin for WordPress is vulnerable to unautho... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-16502 The Live Composer – Free WordPress Website Builder plugin for WordPress is vulne... |
high | 8.8 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-9331 The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable... |
high | 7.1 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-67367 A vulnerability has been identified in SIMOVE Fleetmanager V3.1 (All versions <... |
high | 8.6 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-62649 A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). |
high | 7.5 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-62650 A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). |
high | 8.8 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-62646 A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). |
high | 7.4 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-62647 A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). |
high | 7.4 | — | — | 2026-09-08 | 2026-09-14 |
| CVE-2026-62648 A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). |
high | 7.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-34223 A vulnerability has been identified in Desigo CC ClickOnce Client V6 (All versio... |
high | 8.2 | — | — | 2026-09-08 | 2026-09-14 |
| CVE-2026-81798 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-81806 Server-Side Request Forgery (SSRF) vulnerability in John Darrel Hide My WP Ghost... |
high | 7.2 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-84817 Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.1 versions... |
high | 7.1 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-84818 Unauthenticated Cross Site Scripting (XSS) in Open User Map <= 1.4.50 versions. |
high | 7.1 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-84820 Unauthenticated Cross Site Scripting (XSS) in Unlimited Elements For Elementor (... |
high | 7.1 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-76561 A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority compo... |
high | 7.2 | — | — | 2026-09-08 | 2026-10-21 |
| CVE-2026-81781 Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce... |
high | 7.1 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-81790 Missing Authorization vulnerability in Viszt Péter Csomagpontok és szállítási cí... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-71375 Improper restriction of XML external entity reference vulnerability in Cosminexu... |
high | 7.4 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-48888 Allocation of Resources Without Limits or Throttling vulnerability in Automattic... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-76967 SAP NetWeaver Business Client does not perform sufficient validation when proces... |
high | 7.8 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-76958 SAP Integration Suite does not sufficiently validate XML documents accepted from... |
high | 8.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-66767 SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenti... |
high | 7.7 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-86544 knowns versions before 0.30.0 contain an authorization bypass vulnerability wher... |
high | 8.1 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86439 knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool argu... |
high | 8.8 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86538 knowns versions before 0.30.0 contain a path traversal vulnerability in the POST... |
high | 7.5 | — | — | 2026-09-07 | 2026-09-14 |
| CVE-2026-86539 knowns through 0.33.0 contains a server-side request forgery vulnerability in th... |
high | 7.2 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86540 knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary... |
high | 7.8 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86541 knowns versions before 0.30.0 contain a path traversal vulnerability in the hand... |
high | 8.3 | — | — | 2026-09-07 | 2026-09-10 |
| CVE-2026-86437 Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/up... |
high | 7.2 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86438 Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser inst... |
high | 7.2 | — | — | 2026-09-07 | 2026-09-10 |
| CVE-2026-86287 Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths. |
high | 7.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-16028 Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed... |
high | 7.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86498 In JetBrains YouTrack before 2025.3.160480,
2026.1.14047 pUT requests on link s... |
high | 7.7 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86502 In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the... |
high | 8.4 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86504 In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation be... |
high | 7.8 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86492 In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-ten... |
high | 8.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86494 In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthori... |
high | 7.7 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86479 In JetBrains YouTrack before 2026.2.18788,
2026.1.14055,
2025.3.161254 missing... |
high | 8.1 | — | — | 2026-09-07 | 2026-09-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.