September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-12985 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 Matterm... |
critical | 9.3 | — | Mattermost / mattermost server | 2026-09-14 | 2026-10-07 |
| CVE-2026-82439 Description
The DRPC server kept a map from function name to request queue and... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-82441 Description
A submitted topology carries two lists of blobstore keys, `dependen... |
critical | 9.1 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-73370 Incorrect Authorization vulnerability in Apache Syncope. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90937 froxlor versions before 2.2.5 fail to validate newline characters in subdomain r... |
critical | 9.9 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-78330 Incorrect privilege assignment vulnerability in Apache Syncope. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-77051 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-77181 Incorrect Authorization vulnerability in Apache Syncope. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-78299 In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a... |
critical | 9.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-73470 Improper Privilege Management vulnerability in Apache Syncope. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-73579 Incorrect Authorization vulnerability in Apache Syncope. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-73668 Incorrect Authorization vulnerability in Apache Syncope. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-75030 Missing Authorization vulnerability in Apache Syncope. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90919 LightLLM through 1.2.0 contains a remote code execution vulnerability in the Con... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-90898 Bifrost registers MCP clients through its management API. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-82232 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-86460 Cypher injection vulnerability in the Neo4j persistence layer when processing so... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-87785 Authentication bypass by spoofing vulnerability in Apache Syncope. |
critical | 9.1 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-87802 Improper verification of cryptographic signature vulnerability in Apache Syncope... |
critical | 9.1 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90702 A flaw has been found in D-Link DWR-M921 1.1.52. |
critical | 9.1 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90703 A vulnerability has been found in D-Link DWR-M921 1.1.52. |
critical | 9.1 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90699 A weakness has been identified in D-Link DWR-M920 1.1.7. |
critical | 9.9 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90693 A flaw has been found in D-Link DIR-878 120B05. |
critical | 9.9 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90692 A vulnerability was detected in D-Link DIR-878 120B05. |
critical | 9.9 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-82787 Missing authentication for critical function vulnerability exists in CPSL-08P1EN... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90680 A security flaw has been discovered in D-Link DIR-823G 1.0.2B05_20181207. |
critical | 9.9 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90608 A flaw has been found in Totolink A3002MU Hh-B20211125.1046. |
critical | 9.9 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90607 A vulnerability was detected in Totolink A3002MU Hh-B20211125.1046. |
critical | 9.9 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90605 A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. |
critical | 9.9 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90606 A security vulnerability has been detected in Totolink A3002MU Hh-B20211125.1046... |
critical | 9.9 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-81648 The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an... |
critical | 10.0 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90558 sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attri... |
critical | 9.8 | — | — | 2026-09-12 | 2026-09-23 |
| CVE-2026-78006 The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execut... |
critical | 9.8 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-78159 The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execut... |
critical | 9.8 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-84171 The WP images upload on piclect WordPress plugin through 1.0 does not validate t... |
critical | 9.8 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-85681 The WP Component WordPress plugin through 2.2.4 does not have any capability or... |
critical | 9.8 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-82845 The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied v... |
critical | 9.9 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-81402 The DS Ad Rotator WordPress plugin through 0.8 does not perform any capability c... |
critical | 9.8 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-77005 The CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 does not validate a us... |
critical | 9.6 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-77006 The WebTotem Backups WordPress plugin before 1.1.0 does not validate a user-supp... |
critical | 9.6 | — | — | 2026-09-12 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.