September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-89141 The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPre... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-15402 The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)... |
medium | 6.4 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-18063 The Job Postings plugin for WordPress is vulnerable to Stored Cross-Site Scripti... |
medium | 6.4 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-91002 A weakness has been identified in stamparm maltrail up to 3.0.1. |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-81303 A flaw was found in hawtio-operator. |
medium | 6.3 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-81320 A flaw was found in hawtio-operator. |
medium | 5.5 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-16593 The WP Directory Kit WordPress plugin through 1.5.7 does not sanitize and escape... |
medium | 6.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-17495 moment is a JavaScript date library for parsing, validating, manipulating, and f... |
medium | 5.9 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-18232 The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or... |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-15758 The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plug... |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-90881 A weakness has been identified in D-Link DIR-882 up to 20260814. |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-90878 A vulnerability was determined in vllm-project vLLM up to 0.27.1. |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90857 A vulnerability was detected in SourceCodester College Notes Gallery Management... |
medium | 6.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-91773 Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by r... |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91774 Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams... |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-90851 A flaw has been found in PHPGurukul Hostel Management System 3.0. |
medium | 6.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-91770 IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-reso... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-91772 Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thu... |
medium | 6.1 | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-90848 A weakness has been identified in Governikus AusweisApp up to 2.5.4. |
medium | 4.3 | — | — | 2026-09-15 | 2026-10-26 |
| CVE-2026-91750 WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-85575 The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solu... |
medium | 6.4 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-85657 The Co-Authors, Multiple Authors and Guest Authors in an Author Box with Publish... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-91197 Flowable flowable-engine through 8.0.0 contains an XML external entity injection... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-91198 GrowthBook through 5.0.1 returns unredacted fact table definitions including raw... |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-91199 Refly through 1.1.0 contains a server-side request forgery vulnerability in the... |
medium | 5.0 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-91201 DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-90829 A weakness has been identified in GNU Binutils 2.47. |
medium | 5.3 | — | Gnu / binutils | 2026-09-14 | 2026-09-16 |
| CVE-2026-90830 A security vulnerability has been detected in GNU Binutils 2.47. |
medium | 5.3 | — | Gnu / binutils | 2026-09-14 | 2026-09-16 |
| CVE-2026-90831 A vulnerability was detected in GNU Binutils 2.47. |
medium | 5.3 | — | Gnu / binutils | 2026-09-14 | 2026-09-16 |
| CVE-2026-81900 Concrete CMS before 9.5.3 applied only trim() to the YouTube block's stored widt... |
medium | 6.1 | — | Concretecms / concrete cms | 2026-09-14 | 2026-09-16 |
| CVE-2026-14986 The ITE it51xxx I2C driver, when operating as an I2C target (slave) in buffer mo... |
medium | 6.8 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-18116 Concrete CMS 8.3.0 to 9.5.2 stored calendar event names without sanitization and... |
medium | 6.1 | — | Concretecms / concrete cms | 2026-09-14 | 2026-09-21 |
| CVE-2026-91146 Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federat... |
medium | 6.1 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-91181 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.... |
medium | 6.5 | — | Mattermost / mattermost server | 2026-09-14 | 2026-10-07 |
| CVE-2026-90828 A security flaw has been discovered in GNU Binutils 2.47. |
medium | 6.6 | — | Gnu / binutils | 2026-09-14 | 2026-09-21 |
| CVE-2026-13265 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 throu... |
medium | 6.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-18117 Concrete CMS 9.0.0 through 9.5.3 is vulnerable to stored XSS via the custom page... |
medium | 5.4 | — | Concretecms / concrete cms | 2026-09-14 | 2026-09-29 |
| CVE-2026-73449 On affected platforms running Arista EOS with both 802.1X port authentication an... |
medium | 5.9 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-76081 ZITADEL is an open source identity management platform. |
medium | 5.5 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-12758 IBM Cloud Pak for Business Automation could allow a remote attacker to bypass au... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.