September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-19887 The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injectio... |
high | 8.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-15984 The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting v... |
high | 7.2 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-16649 The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Script... |
high | 7.2 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86145 PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of... |
high | 8.2 | — | — | 2026-09-05 | 2026-09-09 |
| CVE-2026-77233 The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin... |
high | 7.2 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-77263 The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin... |
high | 7.2 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86142 In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXP... |
high | 7.8 | — | Xmlsoft / libxml2 | 2026-09-05 | 2026-09-15 |
| CVE-2026-86143 In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback an... |
high | 7.3 | — | Xmlsoft / libxml2 | 2026-09-05 | 2026-09-15 |
| CVE-2026-86144 In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessT... |
high | 7.8 | — | Xmlsoft / libxml2 | 2026-09-05 | 2026-09-15 |
| CVE-2026-86138 In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow an... |
high | 7.8 | — | Xmlsoft / libxml2 | 2026-09-05 | 2026-09-15 |
| CVE-2026-86139 In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow. |
high | 7.8 | — | Xmlsoft / libxml2 | 2026-09-05 | 2026-09-15 |
| CVE-2026-86140 In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-base... |
high | 7.8 | — | Xmlsoft / libxml2 | 2026-09-05 | 2026-09-15 |
| CVE-2026-52775 YesWiki is a wiki system written in PHP. |
high | 8.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-52767 YesWiki is a wiki system written in PHP. |
high | 8.2 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-52769 YesWiki is a wiki system written in PHP. |
high | 8.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-52770 YesWiki is a wiki system written in PHP. |
high | 7.5 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-52771 YesWiki is a wiki system written in PHP. |
high | 8.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86095 Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in... |
high | 7.8 | — | — | 2026-09-04 | 2026-09-24 |
| CVE-2026-86098 ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in th... |
high | 7.4 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-48019 Laravel is a web application framework. |
high | 8.9 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-77393 In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shi... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-82684 Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a Mi... |
high | 8.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-86090 ntopng before 6.7.260717 fails to perform authorization checks in the delete end... |
high | 7.1 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-86091 ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete... |
high | 7.1 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-82712 Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a cr... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85702 A security vulnerability has been detected in ramon-victor freegpt-webui up to 0... |
high | 7.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-75438 Buffer Overflow vulnerability in Open5GS v2.7.7 allows a remote attacker to caus... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-75439 An issue in Free5GC v.4.2.2 allows a remote attacker to cause a denial of servic... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-14 |
| CVE-2026-79423 An authenticated remote code execution (RCE) vulnerability in the admin_config.p... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-79426 An arbitrary file deletion vulnerability in the /adminapi/file/video_data_save c... |
high | 7.2 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-85786 Improper handling of highly compressed data in Amazon ion-java before 1.12.1 mig... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-79389 Trueview T18161 S 6.0.23.4 contains an improper verification in MQTT command pro... |
high | 7.4 | — | — | 2026-09-04 | 2026-09-14 |
| CVE-2026-79390 Trueview TI8161 6.0.23.4 is vulnerable to information disclosure due to the tran... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-71622 SQL injection vulnerability in Zhao-github APiAdmin v.5.0.1 allows a remote atta... |
high | 7.4 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-71626 An issue in Invoice Ninja v5.13.24 allows a remote attacker to obtain sensitive... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-61699 nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. |
high | 8.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-63464 nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. |
high | 7.7 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-53932 laravel-backup-restore restores database backups made with spatie/laravel-backup... |
high | 8.0 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-85781 Unverified ownership of a storage access point in the volume deletion component... |
high | 8.7 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85638 A weakness has been identified in jofpin trape 2.0. |
high | 7.3 | — | — | 2026-09-04 | 2026-09-11 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.