September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-90501 A security vulnerability has been detected in lenve vhr 1.0-SNAPSHOT. |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90500 A weakness has been identified in lenve vhr 1.0-SNAPSHOT. |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90499 A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. |
medium | 5.4 | — | — | 2026-09-13 | 2026-09-21 |
| CVE-2026-80072 The User Registration & Membership WordPress plugin before 5.2.8 does not valida... |
medium | 4.7 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-88764 The Simple Membership WordPress plugin before 4.7.8 does not validate that the m... |
medium | 5.4 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-88912 The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12... |
medium | 4.2 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-88995 The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does... |
medium | 5.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90496 A vulnerability was found in Fengoffice Feng Office up to 3.11.13.11. |
medium | 4.7 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-77773 The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2... |
medium | 5.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90679 Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a... |
medium | 4.3 | — | — | 2026-09-13 | 2026-09-22 |
| CVE-2026-90494 A flaw has been found in restify node-restify up to 12.0.0. |
medium | 5.3 | — | — | 2026-09-13 | 2026-09-21 |
| CVE-2026-90492 A security vulnerability has been detected in webgjc web_robot 2.4.0/2.5.0/2.8.0... |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90491 A weakness has been identified in sanjevirau gsubs up to 1.0.3. |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90490 A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90488 A vulnerability was determined in Xuxueli xxl-job up to 3.4.2. |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90486 A vulnerability has been found in openstatusHQ openstatus up to f04c827112f30a11... |
medium | 6.3 | — | — | 2026-09-12 | 2026-09-15 |
| CVE-2026-90487 A vulnerability was found in Xuxueli xxl-job up to 3.4.2. |
medium | 4.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-90485 A flaw has been found in IOBit Uninstaller 15.5.0.11. |
medium | 5.5 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-90557 Freeciv versions 3.1.0 through 3.2.5 contain an out-of-bounds read vulnerability... |
medium | 6.1 | — | — | 2026-09-12 | 2026-09-23 |
| CVE-2026-90555 vLLM versions before 0.28.0 fail to validate audio sample rate headers in the tr... |
medium | 6.5 | — | Vllm / vllm | 2026-09-12 | 2026-09-16 |
| CVE-2026-90547 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to val... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-15 |
| CVE-2026-90548 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to val... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-90549 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to pro... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-90550 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to che... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-90551 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to val... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-21 |
| CVE-2026-90552 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to val... |
medium | 4.3 | — | — | 2026-09-12 | 2026-09-15 |
| CVE-2026-90540 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to val... |
medium | 4.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-90541 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to req... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-19 |
| CVE-2026-90542 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to val... |
medium | 5.4 | — | — | 2026-09-12 | 2026-09-15 |
| CVE-2026-90543 WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier, with... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-90544 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to val... |
medium | 4.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-90545 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to val... |
medium | 4.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-90546 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to val... |
medium | 4.3 | — | — | 2026-09-12 | 2026-09-21 |
| CVE-2026-90533 Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/... |
medium | 6.5 | — | Flowiseai / flowise | 2026-09-12 | 2026-09-15 |
| CVE-2026-90534 Flowise is a low-code platform for building LLM applications. |
medium | 6.5 | — | Flowiseai / flowise | 2026-09-12 | 2026-09-15 |
| CVE-2026-90536 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to aut... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-21 |
| CVE-2026-90538 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a m... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-90539 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a m... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-10148 The Booking for Appointments and Events Calendar plugin for WordPress is vulnera... |
medium | 6.4 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-90472 msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUn... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.