September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86317 A vulnerability was detected in ggml-org llama.cpp up to 0.4.0. |
medium | 5.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-80056 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 5.5 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-11 |
| CVE-2026-80057 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 5.5 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-11 |
| CVE-2026-78488 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 6.5 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-11 |
| CVE-2026-86308 A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99... |
medium | 5.3 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86309 A flaw has been found in itsourcecode Sales and Inventory System 1.0. |
medium | 6.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86310 A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. |
medium | 6.3 | — | — | 2026-09-07 | 2026-09-11 |
| CVE-2026-80170 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 6.5 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-11 |
| CVE-2026-86307 A security vulnerability has been detected in light0011 cms c774dce31c6df0055568... |
medium | 4.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-78487 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 5.5 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-09 |
| CVE-2026-80128 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 6.5 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-09 |
| CVE-2026-12757 The The Email Subscribers & Newsletters – Email Marketing, Post Notifications &... |
medium | 6.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86440 Affected versions of MISP insufficiently validate URLs used by dashboard widgets... |
medium | 5.4 | — | Misp-project / misp | 2026-09-07 | 2026-09-09 |
| CVE-2026-86441 Affected versions of MISP contain inconsistent authorization checks across dashb... |
medium | 4.3 | — | Misp-project / misp | 2026-09-07 | 2026-09-09 |
| CVE-2026-86451 Affected versions of MISP allow authenticated users to retrieve object-reference... |
medium | 4.3 | — | Misp-project / misp | 2026-09-07 | 2026-09-09 |
| CVE-2026-8279 The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deleti... |
medium | 5.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86432 commonmark versions from 2.0.0 before 2.8.4 contain a denial of service vulnerab... |
medium | 5.3 | — | — | 2026-09-07 | 2026-10-08 |
| CVE-2026-86423 ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after... |
medium | 5.5 | — | Imagemagick / imagemagick | 2026-09-07 | 2026-09-09 |
| CVE-2026-86425 ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after... |
medium | 5.5 | — | Imagemagick / imagemagick | 2026-09-07 | 2026-09-09 |
| CVE-2026-86408 Affected versions of MISP do not enforce parent-event visibility when serving cr... |
medium | 6.5 | — | Misp-project / misp | 2026-09-07 | 2026-09-09 |
| CVE-2026-86416 ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vuln... |
medium | 5.4 | — | — | 2026-09-07 | 2026-09-18 |
| CVE-2026-86417 Affected versions of MISP inconsistently enforced email-address visibility in Da... |
medium | 4.3 | — | Misp-project / misp | 2026-09-07 | 2026-09-09 |
| CVE-2026-86418 Affected versions of MISP expose organisation metadata through the dashboard org... |
medium | 4.3 | — | Misp-project / misp | 2026-09-07 | 2026-09-14 |
| CVE-2026-80135 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 5.3 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-11 |
| CVE-2026-86302 A vulnerability was found in code-projects Hospital Information System 1.0. |
medium | 5.3 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-4945 The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plu... |
medium | 5.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-12853 The Flamingo plugin for WordPress is vulnerable to authorization bypass in all v... |
medium | 5.4 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2022-51012 PocketMine-MP versions before 4.2.9 fail to properly validate NBT data types dur... |
medium | 6.5 | — | — | 2026-09-07 | 2026-10-08 |
| CVE-2022-51013 PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in t... |
medium | 6.5 | — | — | 2026-09-07 | 2026-10-08 |
| CVE-2022-51014 PocketMine-MP before 4.0.7 contains an unhandled exception vulnerability in the... |
medium | 6.5 | — | — | 2026-09-07 | 2026-10-08 |
| CVE-2022-51015 PocketMine-MP before 4.0.6 does not validate facing values in PlayerActionPacket... |
medium | 6.5 | — | — | 2026-09-07 | 2026-10-08 |
| CVE-2022-51016 PocketMine-MP 3.x (before 3.27.0) does not implement Minecraft Bedrock protocol... |
medium | 6.1 | — | — | 2026-09-07 | 2026-10-08 |
| CVE-2022-51018 PocketMine-MP before 3.26.5 and 4.0.x before 4.0.5 does not limit book page text... |
medium | 6.5 | — | — | 2026-09-07 | 2026-10-08 |
| CVE-2022-51011 PocketMine-MP before 4.2.10 fails to validate the total length of incoming chat... |
medium | 4.3 | — | — | 2026-09-07 | 2026-10-08 |
| CVE-2022-51010 PocketMine-MP versions before 4.4.2 fail to properly validate item IDs received... |
medium | 6.5 | — | — | 2026-09-07 | 2026-10-08 |
| CVE-2026-2390 The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting v... |
medium | 6.4 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86351 Affected versions of MISP validate the user-configurable homepage by checking on... |
medium | 6.1 | — | Misp-project / misp | 2026-09-07 | 2026-09-09 |
| CVE-2026-86294 A vulnerability has been found in SourceCodester Simple Traffic Offense System 1... |
medium | 4.3 | — | — | 2026-09-07 | 2026-09-11 |
| CVE-2026-85640 Zohocorp ManageEngine Endpoint Central versions below 11.5.2600.15 are vulnerabl... |
medium | 6.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-77699 Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 are vulnerabl... |
medium | 5.0 | — | — | 2026-09-07 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.