September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-88846 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not che... |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-88847 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not ver... |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-89002 The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitize... |
medium | 6.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-89005 The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise... |
medium | 6.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-80338 The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on... |
medium | 6.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-82195 The 10Web Booster WordPress plugin before 2.34.0 does not restrict access to the... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-82849 The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user ma... |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-82850 The Masteriyo LMS WordPress plugin before 3.4.2 does not restrict access to quiz... |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-74991 The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment... |
medium | 6.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97155 Fabasoft Folio Client before 2026, a locally installed component that communicat... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-26 |
| CVE-2026-96892 A flaw has been found in Edimax BR-6428nC 1.16. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96881 A vulnerability was determined in TaleLin lin-cms-spring-boot up to 0.2.1. |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96882 A vulnerability was identified in TaleLin lin-cms-spring-boot up to 0.2.1. |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-96884 A security flaw has been discovered in MantisZip up to 0.4.5. |
medium | 6.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96880 A vulnerability was found in TaleLin lin-cms-spring-boot up to 0.2.1. |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97056 SigNoz versions from v0.98.0 up to (but not including) v0.143.0, when configured... |
medium | 6.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96777 A vulnerability was determined in Forma LMS up to 4.1.43. |
medium | 6.3 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-96772 A security flaw has been discovered in Intelliants Subrion CMS up to 4.2.1. |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96773 A weakness has been identified in Intelliants Subrion CMS up to 4.2.1. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96774 A vulnerability was found in SPON Communications IP Network Audio Device XC-9603... |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96763 A security flaw has been discovered in kvcache-ai mooncake up to 0.3.12/0.3.13.p... |
medium | 5.4 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-96764 A weakness has been identified in kvcache-ai mooncake up to 0.3.12/0.3.14-rc1. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-92529 GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 bef... |
medium | 4.3 | — | Gitlab / gitlab | 2026-09-24 | 2026-09-28 |
| CVE-2026-92530 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1... |
medium | 4.3 | — | Gitlab / gitlab | 2026-09-24 | 2026-09-28 |
| CVE-2026-92874 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3... |
medium | 5.4 | — | Gitlab / gitlab | 2026-09-24 | 2026-09-28 |
| CVE-2026-96739 A flaw has been found in SEMCMS up to 4.2. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96680 A vulnerability was detected in ByteDance Coze Scraper Extension up to 2.0.2. |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96606 A security flaw has been discovered in LB-Link BL-CPE600EU 5.8.13. |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-29 |
| CVE-2026-96676 A vulnerability was identified in Fast FAC1900R 20190827_2.0.2. |
medium | 6.3 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96678 A security vulnerability has been detected in weiqingwen spring-boot-forum up to... |
medium | 6.3 | — | — | 2026-09-23 | 2026-09-29 |
| CVE-2026-80423 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
medium | 6.5 | — | Ibm / datastage on cloud pak for data | 2026-09-23 | 2026-10-06 |
| CVE-2026-6925 IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to traverse direct... |
medium | 5.3 | — | Ibm / concert | 2026-09-23 | 2026-09-28 |
| CVE-2026-67235 RabbitMQ is a messaging and streaming broker. |
medium | 6.5 | — | Broadcom / rabbitmq server | 2026-09-23 | 2026-10-19 |
| CVE-2026-67240 RabbitMQ is a messaging and streaming broker. |
medium | 6.5 | — | Broadcom / rabbitmq server | 2026-09-23 | 2026-10-30 |
| CVE-2026-6718 IBM Concert 1.0.0 through 3.0.0 is vulnerable to improper access control which a... |
medium | 6.2 | — | Ibm / concert | 2026-09-23 | 2026-09-28 |
| CVE-2026-67219 RabbitMQ is a messaging and streaming broker. |
medium | 6.5 | — | Broadcom / rabbitmq server | 2026-09-23 | 2026-10-19 |
| CVE-2026-67220 RabbitMQ is a messaging and streaming broker. |
medium | 6.5 | — | Broadcom / rabbitmq server | 2026-09-23 | 2026-10-19 |
| CVE-2026-67221 RabbitMQ is a messaging and streaming broker. |
medium | 4.9 | — | Broadcom / rabbitmq server | 2026-09-23 | 2026-10-19 |
| CVE-2026-67224 RabbitMQ is a messaging and streaming broker. |
medium | 4.9 | — | Broadcom / rabbitmq server | 2026-09-23 | 2026-10-19 |
| CVE-2026-67228 RabbitMQ is a messaging and streaming broker. |
medium | 4.9 | — | Broadcom / rabbitmq server | 2026-09-23 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.