September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92967 The Pochipp plugin for WordPress is vulnerable to Reflected Cross-Site Scripting... |
medium | 6.1 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-88944 The Tutor LMS – eLearning and online course solution plugin for WordPress is vul... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-89081 The Tutor LMS – eLearning and online course solution plugin for WordPress is vul... |
medium | 6.1 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-89093 The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots pl... |
medium | 5.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-89333 The Tutor LMS – eLearning and online course solution plugin for WordPress is vul... |
medium | 6.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-89334 The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots pl... |
medium | 6.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-15660 The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in v... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-15760 The Divi Essential plugin for WordPress is vulnerable to sensitive information e... |
medium | 6.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-12042 The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Si... |
medium | 4.4 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-77820 The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
medium | 6.4 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-93921 SiYuan versions through 3.8.4 fail to enforce publish access control in the getD... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-93574 A flaw was found in Netty's `netty-codec-http` component. |
medium | 6.5 | — | — | 2026-09-18 | 2026-10-15 |
| CVE-2026-93562 A flaw was found in Netty's HTTP/1 decoder. |
medium | 6.5 | — | — | 2026-09-18 | 2026-10-15 |
| CVE-2026-85271 Open edX Platform enables the authoring and delivery of online learning at any s... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-85272 Open edX Platform enables the authoring and delivery of online learning at any s... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-63449 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
medium | 5.3 | — | Oisf / suricata | 2026-09-18 | 2026-09-28 |
| CVE-2026-63450 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
medium | 5.3 | — | Oisf / suricata | 2026-09-18 | 2026-09-28 |
| CVE-2026-63451 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
medium | 5.5 | — | Oisf / suricata | 2026-09-18 | 2026-09-28 |
| CVE-2026-57225 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
medium | 5.5 | — | Oisf / suricata | 2026-09-18 | 2026-09-28 |
| CVE-2026-57229 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
medium | 5.3 | — | Oisf / suricata | 2026-09-18 | 2026-09-28 |
| CVE-2026-61670 microsandbox is an easy, fast, local-first microVM runtime and library. |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-93871 Cotonti through 1.0.0 fails to validate redirect destinations in page bodies pre... |
medium | 5.4 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93873 Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the contact plugin s... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93840 vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead... |
medium | 5.3 | — | Vllm / vllm | 2026-09-18 | 2026-09-28 |
| CVE-2026-93841 vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bi... |
medium | 5.3 | — | Vllm / vllm | 2026-09-18 | 2026-09-28 |
| CVE-2026-93869 Cotonti through 1.0.0 contains an open redirect vulnerability in the cot_url_che... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93870 Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin A... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93838 SGLang versions through 0.5.20 contain an unbounded memory allocation vulnerabil... |
medium | 5.9 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-91202 A flaw was found in cockpit-files. |
medium | 6.1 | — | — | 2026-09-18 | 2026-10-19 |
| CVE-2026-91203 A flaw was found in cockpit-files. |
medium | 6.0 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-91205 A flaw was found in cockpit-files. |
medium | 6.0 | — | — | 2026-09-18 | 2026-10-19 |
| CVE-2026-82890 IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to... |
medium | 5.9 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-76902 CordysCRM is an open source AI-powered customer relationship management system t... |
medium | 5.0 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-77528 Autobahn Python is a WebSocket and WAMP implementation for Python that supports... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-76899 CordysCRM is an open source AI-powered customer relationship management system t... |
medium | 5.7 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-76900 CordysCRM is an open source AI-powered customer relationship management system t... |
medium | 6.8 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-76901 CordysCRM is an open source AI-powered customer relationship management system t... |
medium | 5.8 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-61822 pg_partman is a PostgreSQL extension that manages partitioned tables by time or... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-61720 FluidSynth is a software synthesizer based on the SoundFont 2 specifications. |
medium | 6.2 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-61722 FluidSynth is a software synthesizer based on the SoundFont 2 specifications. |
medium | 6.8 | — | — | 2026-09-18 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.