September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86731 Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard i... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-19 |
| CVE-2026-86734 Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST... |
medium | 6.5 | — | Snipeitapp / snipe-it | 2026-09-08 | 2026-09-10 |
| CVE-2026-86724 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-86726 AVideo through 29.0 contains an information disclosure vulnerability in restream... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-19 |
| CVE-2026-86719 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master) con... |
medium | 5.4 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-79573 L-ONE v1.0.0 was discovered to contain multiple SQL injection vulnerabilities in... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-14 |
| CVE-2026-56101 OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in t... |
medium | 5.3 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-84282 A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownC... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-11891 Use After Free vulnerability in Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Ar... |
medium | 5.1 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-12285 Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valha... |
medium | 4.0 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-12387 Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valha... |
medium | 5.1 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-0001 Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valha... |
medium | 4.4 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-78838 A reflected cross-site scripting (XSS) vulnerability in the grid_datasource.php... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-79379 A buffer overflow in the SBC_DecodeFrames() function of Bestechnic Co., Ltd BES2... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-14 |
| CVE-2026-73319 XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynam... |
medium | 6.1 | — | Xenforo / xenforo | 2026-09-08 | 2026-09-11 |
| CVE-2026-73320 XenForo before 2.3.13 contains an unauthenticated information disclosure vulnera... |
medium | 6.1 | — | Xenforo / xenforo | 2026-09-08 | 2026-09-11 |
| CVE-2026-73321 XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BB... |
medium | 6.5 | — | Xenforo / xenforo | 2026-09-08 | 2026-09-11 |
| CVE-2026-73310 XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoin... |
medium | 5.9 | — | Xenforo / xenforo | 2026-09-08 | 2026-09-11 |
| CVE-2026-33387 A template injection vulnerability was discovered in the Dashboards functionalit... |
medium | 4.6 | — | — | 2026-09-08 | 2026-10-15 |
| CVE-2026-33391 An access control vulnerability was discovered in the Smart Polling configuratio... |
medium | 5.4 | — | — | 2026-09-08 | 2026-10-15 |
| CVE-2026-79603 x86 PV guests can free memory pages while still keeping a stale TLB entry
pointi... |
medium | 4.3 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-62437 When guests are terminated, various pieces of cleanup need carrying out. |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-86714 PX4 Autopilot through 1.17.0 contains a stack buffer over-read vulnerability in... |
medium | 5.4 | — | — | 2026-09-08 | 2026-09-14 |
| CVE-2026-76931 The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Si... |
medium | 6.4 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-2520 The Online Scheduling and Appointment Booking System – Bookly plugin for WordPre... |
medium | 5.4 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-17509 The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL I... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-18021 The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for W... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-12230 The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin... |
medium | 6.4 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-86550 NuBrowser lacks protocol whitelist validation for the S.browser_fallback_url fie... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-86597 Insertion of sensitive information into log files in the Snowflake Python, Go, J... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-74859 The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives wi... |
medium | 6.8 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-62652 A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). |
medium | 5.3 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-62653 A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). |
medium | 6.8 | — | — | 2026-09-08 | 2026-09-14 |
| CVE-2026-62654 A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). |
medium | 6.8 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-58113 A vulnerability has been identified in Teamcenter V2412 (All versions < V2412.00... |
medium | 6.1 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-81802 Unauthenticated Insecure Direct Object References (IDOR) in WpEvently <= 5.6.0 v... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-81792 Incorrect Privilege Assignment vulnerability in MultiVendorX Product Catalog Enq... |
medium | 6.5 | — | — | 2026-09-08 | 2026-10-07 |
| CVE-2026-86519 A vulnerability was found in code-projects Student Crud Operation 1.0. |
medium | 5.3 | — | — | 2026-09-08 | 2026-09-11 |
| CVE-2026-86516 A vulnerability was detected in elenavanengelenmaslova mocknest-serverless 0.9.0... |
medium | 4.7 | — | — | 2026-09-08 | 2026-09-23 |
| CVE-2026-86517 A flaw has been found in itsourcecode Sales and Inventory System 1.0. |
medium | 6.3 | — | — | 2026-09-08 | 2026-10-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.