September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-81918 Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field i... |
medium | 4.8 | — | Concretecms / concrete cms | 2026-09-11 | 2026-09-18 |
| CVE-2026-81917 Concrete CMS below 9.5.3 does not apply HTML output escaping to the file descrip... |
medium | 5.4 | — | Concretecms / concrete cms | 2026-09-11 | 2026-09-18 |
| CVE-2026-68535 Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not... |
medium | 4.3 | — | Concretecms / concrete cms | 2026-09-11 | 2026-09-24 |
| CVE-2026-49439 OpenRemote is an open-source internet-of-things platform. |
medium | 4.3 | — | — | 2026-09-11 | 2026-09-23 |
| CVE-2026-45057 matrix-sdk-ui provides GUI-centric utilities on top of matrix-rust-sdk. |
medium | 4.9 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-89332 Inclusion of functionality from an untrusted control sphere in the Kiro Powers f... |
medium | 5.5 | — | Amazon / kiro ide | 2026-09-11 | 2026-09-16 |
| CVE-2026-81913 Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via th... |
medium | 6.1 | — | Concretecms / concrete cms | 2026-09-11 | 2026-09-24 |
| CVE-2026-81915 Concrete CMS below 9.5.3 does not perform an object-level authorization check wh... |
medium | 5.3 | — | Concretecms / concrete cms | 2026-09-11 | 2026-09-24 |
| CVE-2026-81916 Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry... |
medium | 4.3 | — | Concretecms / concrete cms | 2026-09-11 | 2026-09-18 |
| CVE-2026-81911 Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom... |
medium | 5.4 | — | Concretecms / concrete cms | 2026-09-11 | 2026-09-18 |
| CVE-2026-81912 Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Mov... |
medium | 5.7 | — | Concretecms / concrete cms | 2026-09-11 | 2026-09-24 |
| CVE-2026-79035 A reflected cross-site scripting (XSS) vulnerability in the p.rfihub.com compone... |
medium | 6.1 | — | — | 2026-09-11 | 2026-09-22 |
| CVE-2026-77490 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Microsoft / edge chromium | 2026-09-11 | 2026-09-25 |
| CVE-2026-68526 Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar ev... |
medium | 4.3 | — | Concretecms / concrete cms | 2026-09-11 | 2026-09-25 |
| CVE-2026-49462 NL Portal Backend Libraries provide backend components for Dutch government port... |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-49463 NL Portal Backend Libraries provide backend components for Dutch government port... |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-89329 A flaw was found in `multipathd`. |
medium | 6.2 | — | — | 2026-09-11 | 2026-09-16 |
| CVE-2026-81910 Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SS... |
medium | 6.5 | — | Concretecms / concrete cms | 2026-09-11 | 2026-09-16 |
| CVE-2026-62136 Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price C... |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-62137 Unauthenticated Sensitive Data Exposure in bbPress <= 2.6.14 versions. |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-62138 Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.... |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-62139 Unauthenticated Cross Site Request Forgery (CSRF) in Site Kit by Google <= 1.186... |
medium | 4.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-62140 Unauthenticated Insecure Direct Object References (IDOR) in Quiz And Survey Mast... |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-62113 Contributor Insecure Direct Object References (IDOR) in Slim SEO <= 4.10.0 versi... |
medium | 4.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-62114 Unauthenticated Broken Access Control in Passster <= 4.3.13 versions. |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-62132 Subscriber Broken Access Control in Masteriyo - LMS <= 3.4.0 versions. |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-62133 Subscriber Cross Site Request Forgery (CSRF) in RTMKit <= 2.1.5 versions. |
medium | 5.4 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-62134 Contributor Insecure Direct Object References (IDOR) in Starter Templates <= 4.7... |
medium | 4.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-62135 Unauthenticated Broken Access Control in Booktics <= 1.0.24 versions. |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-62110 Contributor Cross Site Scripting (XSS) in Bold Page Builder <= 5.9.9 versions. |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-62111 Contributor Cross Site Scripting (XSS) in Simple Payment <= 2.5.4 versions. |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-27378 Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCo... |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-62088 Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticP... |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2025-69904 Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an ad... |
medium | 4.9 | — | — | 2026-09-11 | 2026-10-26 |
| CVE-2026-89090 An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go... |
medium | 5.9 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-9160 Improper neutralization of special elements used in a template engine vulnerabil... |
medium | 4.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-82535 Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vuln... |
medium | 6.1 | — | — | 2026-09-11 | 2026-09-24 |
| CVE-2026-7298 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | — | 2026-09-11 | 2026-09-25 |
| CVE-2026-18495 A flaw was found in libtiff. |
medium | 6.1 | — | — | 2026-09-11 | 2026-10-07 |
| CVE-2026-18061 Improper restriction of XML external entity references in the RemoteQueryCachePl... |
medium | 5.9 | — | Amazon / advanced jdbc wrapper | 2026-09-11 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.