September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-19087 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local... |
medium | 4.4 | — | Ibm / financial transaction manager | 2026-09-23 | 2026-10-07 |
| CVE-2026-18180 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
medium | 6.5 | — | Ibm / financial transaction manager | 2026-09-23 | 2026-10-07 |
| CVE-2026-96599 Isotope eCommerce through 2.9.10 derives order identifiers from uniqid() instead... |
medium | 5.9 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96600 Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in... |
medium | 5.5 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96276 If a malicious SDK container declares an extension point with a crafted `directo... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-27 |
| CVE-2026-92164 Streamlink is a CLI utility which pipes video streams from various services into... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-29 |
| CVE-2026-88974 WPGraphQL provides a GraphQL API for WordPress sites. |
medium | 5.4 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-73858 Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building too... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-73586 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
medium | 6.4 | — | Dell / policy manager for secure connect gateway | 2026-09-23 | 2026-09-25 |
| CVE-2026-73587 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
medium | 6.8 | — | Dell / policy manager for secure connect gateway | 2026-09-23 | 2026-09-25 |
| CVE-2026-73589 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
medium | 6.3 | — | Dell / policy manager for secure connect gateway | 2026-09-23 | 2026-09-25 |
| CVE-2026-71177 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
medium | 5.4 | — | Dell / policy manager for secure connect gateway | 2026-09-23 | 2026-09-25 |
| CVE-2026-61834 scim-patch is a library for applying SCIM patch operations. |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-62998 REDAXO is a PHP-based content management system. |
medium | 4.3 | — | Redaxo / redaxo | 2026-09-23 | 2026-10-19 |
| CVE-2026-63000 REDAXO is a PHP-based content management system. |
medium | 6.4 | — | Redaxo / redaxo | 2026-09-23 | 2026-10-19 |
| CVE-2026-63001 REDAXO is a PHP-based content management system. |
medium | 4.8 | — | Redaxo / redaxo | 2026-09-23 | 2026-10-19 |
| CVE-2026-63002 REDAXO is a PHP-based content management system. |
medium | 4.8 | — | Redaxo / redaxo | 2026-09-23 | 2026-10-19 |
| CVE-2026-61413 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
medium | 6.8 | — | Dell / policy manager for secure connect gateway | 2026-09-23 | 2026-09-25 |
| CVE-2026-18179 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
medium | 6.5 | — | Ibm / financial transaction manager | 2026-09-23 | 2026-10-07 |
| CVE-2026-84091 The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-77112 Server-Side request forgery (SSRF) vulnerability in Global IT Informatics Techno... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-96445 A flaw was found in the Conditional OTP authenticator of Keycloak, an identity a... |
medium | 6.8 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96446 A flaw was found in the Pushed Authorization Request PAR implementation of Keycl... |
medium | 4.2 | — | — | 2026-09-23 | 2026-09-26 |
| CVE-2026-80444 URL redirection to untrusted site ('open redirect') vulnerability in Abis Techno... |
medium | 5.4 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-73581 Improper Check for Certificate Revocation vulnerability in Apache Tomcat. |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-96456 The Reachy Mini Bluetooth service asks a connecting device for a PIN before it w... |
medium | 6.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-90950 The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-87070 The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a req... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-87071 The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which me... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-87978 The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the re... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-86604 The GTranslate WordPress plugin before 5.0.1 does not remove shortcodes from the... |
medium | 4.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-86612 The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expa... |
medium | 5.6 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-86601 The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes fr... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-91928 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Apache / sling xss protection api | 2026-09-23 | 2026-09-30 |
| CVE-2026-91999 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Apache / sling xss protection api | 2026-09-23 | 2026-09-30 |
| CVE-2026-92001 Improper restriction of recursive entity references in DTDs ('XML entity expansi... |
medium | 6.1 | — | Apache / sling xss protection api | 2026-09-23 | 2026-09-30 |
| CVE-2026-94251 A vulnerability in Apache Sling Security Bundle: ContentDispositionFilter mediat... |
medium | 6.5 | — | Apache / sling security | 2026-09-23 | 2026-10-06 |
| CVE-2026-96443 Insufficient validation of the JDBC driver URL in Apache Doris allows a privileg... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-73192 An improper neutralization of input during web page generation ('Cross-site Scri... |
medium | 6.1 | — | Apache / sling xss protection api | 2026-09-23 | 2026-09-30 |
| CVE-2026-91852 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Apache / sling xss protection api | 2026-09-23 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.