September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-44506 Medplum is a developer platform that enables development of healthcare apps. |
high | 8.2 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-53728 Medplum is a developer platform that enables development of healthcare apps. |
high | 7.1 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-85393 node-forge through 1.4.0 fails to validate element count in nested DigestAlgorit... |
high | 7.5 | — | — | 2026-09-03 | 2026-09-24 |
| CVE-2026-85395 UnoPim before 2.1.3 fails to include integration store, update, and key-generati... |
high | 7.1 | — | — | 2026-09-03 | 2026-09-23 |
| CVE-2026-85396 rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Ent... |
high | 7.5 | — | — | 2026-09-03 | 2026-09-24 |
| CVE-2026-85028 Creation of a temporary file in a directory with insecure permissions in the FPG... |
high | 7.8 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85388 Worklenz through 3.0.0 fails to properly validate the sort-field query parameter... |
high | 8.1 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85390 Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenanc... |
high | 7.1 | — | — | 2026-09-03 | 2026-09-10 |
| CVE-2026-82302 Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configurati... |
high | 8.1 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-78583 Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via... |
high | 8.1 | — | Elastic / kibana | 2026-09-03 | 2026-09-08 |
| CVE-2026-33630 c-ares is an asynchronous resolver library. |
high | 7.5 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-85012 Improper neutralization of special elements used in an OS command (CWE-78) in th... |
high | 8.0 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85187 A security vulnerability has been detected in itsourcecode Online Medicine Deliv... |
high | 7.3 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-83959 Substance3D - Sampler is affected by a Heap-based Buffer Overflow vulnerability... |
high | 7.8 | — | Adobe / substance 3d sampler | 2026-09-03 | 2026-09-08 |
| CVE-2026-63219 GeoNetwork is a catalog application to manage spatially referenced resources. |
high | 8.6 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-84812 Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 vers... |
high | 7.1 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-84836 Subscriber Insecure Direct Object References (IDOR) in WC Ukraine Shipping <= 1.... |
high | 7.1 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84847 Unauthenticated Broken Access Control in Quick Event Manager <= 9.17 versions. |
high | 7.5 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-84848 Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager <= 9.17 versio... |
high | 7.1 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-84773 Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.6 vers... |
high | 7.2 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84776 Unauthenticated Denial of Service Attack in MalCare Security <= 6.69 versions. |
high | 7.5 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-84777 Unauthenticated Broken Authentication in Really Simple SSL <= 9.8.0 versions. |
high | 7.4 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84778 Unauthenticated Denial of Service Attack in Migrate Guru – Site Migration & Clon... |
high | 7.5 | — | — | 2026-09-03 | 2026-09-07 |
| CVE-2026-84779 Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Ag... |
high | 8.1 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84761 Unauthenticated Server Side Request Forgery (SSRF) in LiteSpeed Cache <= 7.9 ver... |
high | 7.2 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-84763 Unauthenticated Cross Site Scripting (XSS) in RTMKit <= 2.1.5 versions. |
high | 7.1 | — | — | 2026-09-03 | 2026-09-07 |
| CVE-2026-84765 Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT <= 7.5.1 versions... |
high | 7.1 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84756 Subscriber Privilege Escalation in WCFM Membership <= 2.11.11 versions. |
high | 7.1 | — | — | 2026-09-03 | 2026-09-07 |
| CVE-2026-84757 Unauthenticated Settings Change in WP Compress <= 7.21.28 versions. |
high | 8.2 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84752 Contributor PHP Object Injection in RTMKit <= 2.1.5 versions. |
high | 8.8 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-81292 Unauthenticated Cross Site Scripting (XSS) in Simple Payment <= 2.5.1 versions. |
high | 7.1 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-81295 Unauthenticated Cross Site Scripting (XSS) in Under Construction <= 5.82 version... |
high | 7.1 | — | — | 2026-09-03 | 2026-09-07 |
| CVE-2026-81300 Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 <=... |
high | 7.1 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-81773 Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension... |
high | 7.1 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-81776 Unauthenticated Cross Site Scripting (XSS) in WP QuickLaTeX <= 3.8.8 versions. |
high | 7.1 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-85236 A cross-site request forgery (CSRF) vulnerability existed in the cullEmptyEvents... |
high | 8.8 | — | Misp-project / misp | 2026-09-03 | 2026-09-11 |
| CVE-2026-85237 A vulnerability in MISP's email-based one-time password (OTP) authentication flo... |
high | 8.1 | — | Misp-project / misp | 2026-09-03 | 2026-09-11 |
| CVE-2026-85137 A security vulnerability has been detected in SeaCMS up to 13.6. |
high | 7.3 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-85138 A vulnerability was detected in SeaCMS up to 13.6. |
high | 7.3 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84964 A double free in the OpenSSL-based TLS certificate revocation checking path of t... |
high | 7.5 | — | Mongodb / c driver | 2026-09-03 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.