September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-21103 Path traversal in GalaxyDiagnostics prior to SMR Sep-2026 Release 1 allows physi... |
medium | 6.1 | — | Samsung / android | 2026-09-09 | 2026-09-10 |
| CVE-2026-21104 Heap-based buffer overflow in KnoxVault trustlet prior to SMR Sep-2026 Release 1... |
medium | 6.7 | — | Samsung / android | 2026-09-09 | 2026-09-11 |
| CVE-2026-21105 Improper access control in Collection prior to version 1.0.1.14 in Android 15 an... |
medium | 5.5 | — | Samsung / collection | 2026-09-09 | 2026-09-23 |
| CVE-2026-21092 Path traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attac... |
medium | 5.3 | — | Samsung / android | 2026-09-09 | 2026-09-11 |
| CVE-2026-21093 Stack-based buffer overflow in PROCA trustlet prior to SMR Sep-2026 Release 1 al... |
medium | 6.7 | — | Samsung / android | 2026-09-09 | 2026-09-11 |
| CVE-2026-21097 Improper authentication in ActivityTaskManagerService prior to SMR Sep-2026 Rele... |
medium | 6.7 | — | Samsung / android | 2026-09-09 | 2026-09-10 |
| CVE-2026-19945 The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 6.4 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-21085 Out-of-bounds write in Keymaster trustlet prior to SMR Sep-2026 Release 1 allows... |
medium | 6.7 | — | Samsung / android | 2026-09-09 | 2026-09-11 |
| CVE-2026-11821 The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)... |
medium | 5.4 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-81644 DoS vulnerability in the preview service module. |
medium | 4.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-81646 Out-of-bounds read vulnerability in the graphics module. |
medium | 5.9 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-81647 Out-of-bounds read vulnerability in the graphics module. |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-7804 The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to... |
medium | 6.1 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-77187 The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to... |
medium | 6.4 | — | — | 2026-09-09 | 2026-09-11 |
| CVE-2026-75966 The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross... |
medium | 6.4 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-77186 The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to... |
medium | 6.4 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-57825 In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can... |
medium | 5.7 | — | — | 2026-09-09 | 2026-09-14 |
| CVE-2026-49313 Permission control vulnerability in the app lock module. |
medium | 5.5 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-49311 Permission control vulnerability in the event notification module.Impact: Succes... |
medium | 6.2 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-49312 Permission control vulnerability in the window module. |
medium | 4.0 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-19797 The User Access Manager plugin for WordPress is vulnerable to Reflected Cross-Si... |
medium | 6.1 | — | — | 2026-09-09 | 2026-09-11 |
| CVE-2026-19800 The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emai... |
medium | 4.9 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-19944 The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection... |
medium | 4.9 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-41987 Permission control vulnerability in the app management module. |
medium | 6.2 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-49309 Permission control vulnerability in the Settings module. |
medium | 4.8 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-11363 The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPr... |
medium | 6.6 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-87035 Tanium addressed an information disclosure vulnerability in Comply. |
medium | 4.3 | — | Tanium / comply | 2026-09-09 | 2026-09-16 |
| CVE-2026-87037 Tanium addressed an improper access controls vulnerability in Comply. |
medium | 5.4 | — | Tanium / comply | 2026-09-09 | 2026-09-16 |
| CVE-2026-87046 Tanium addressed an improper access controls vulnerability in Comply. |
medium | 4.3 | — | Tanium / comply | 2026-09-09 | 2026-09-16 |
| CVE-2026-87047 Tanium addressed an improper access controls vulnerability in Comply. |
medium | 6.3 | — | Tanium / comply | 2026-09-09 | 2026-09-16 |
| CVE-2026-87048 Tanium addressed an improper access controls vulnerability in Comply. |
medium | 5.4 | — | Tanium / comply | 2026-09-09 | 2026-09-16 |
| CVE-2026-87073 Tanium addressed an improper access controls vulnerability in Comply. |
medium | 6.5 | — | Tanium / comply | 2026-09-09 | 2026-09-16 |
| CVE-2026-87019 Tanium addressed an improper access controls vulnerability in Comply. |
medium | 4.3 | — | Tanium / comply | 2026-09-09 | 2026-09-16 |
| CVE-2026-87025 Tanium addressed an improper access controls vulnerability in Comply. |
medium | 5.4 | — | Tanium / comply | 2026-09-09 | 2026-09-16 |
| CVE-2026-87032 Tanium addressed an information disclosure vulnerability in Tanium Server. |
medium | 4.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-87033 Tanium addressed an improper access controls vulnerability in Comply. |
medium | 5.4 | — | Tanium / comply | 2026-09-09 | 2026-09-16 |
| CVE-2026-14892 Tanium addressed an improper access controls vulnerability in Tanium Server. |
medium | 4.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-12956 The WP Event Solution (Eventin) plugin for WordPress is vulnerable to Missing Au... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-13709 The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerabl... |
medium | 6.4 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-14505 Tanium addressed a path traversal vulnerability in Tanium Data Service. |
medium | 6.6 | — | — | 2026-09-09 | 2026-09-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.