September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86183 A vulnerability was identified in diem-project diem up to 5.1.3. |
medium | 5.3 | — | — | 2026-09-06 | 2026-09-11 |
| CVE-2026-86179 A flaw has been found in code-projects Daily Expense Manager 1.0. |
medium | 5.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86172 A vulnerability was detected in DefaultFuction CRM 1.0.0. |
medium | 6.3 | — | — | 2026-09-06 | 2026-09-11 |
| CVE-2026-75793 The SureCart WordPress plugin before 4.7.0 does not consult the site's user regi... |
medium | 6.5 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-84028 The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape... |
medium | 6.8 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-85038 The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices,... |
medium | 5.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86171 A security vulnerability has been detected in DefaultFuction CRM 1.0.0. |
medium | 6.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-13159 The Real Estate Papi WordPress theme through 1.0.5 does not perform capability o... |
medium | 4.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86170 A weakness has been identified in DefaultFuction CRM 1.0.0. |
medium | 6.3 | — | — | 2026-09-06 | 2026-09-09 |
| CVE-2026-86164 A security flaw has been discovered in itsourcecode Sales and Inventory System 1... |
medium | 6.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86163 A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. |
medium | 6.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86150 A security vulnerability has been detected in Tenda CP3 27.5.57.101. |
medium | 4.1 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-67279 Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability |
medium | 6.5 | Listed | MikroTik / RouterOS | 2026-09-05 | 2026-09-26 |
| CVE-2026-18238 The rpcap client code that processes a RPCAP_MSG_PACKET message received from th... |
medium | 5.0 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-18313 rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPC... |
medium | 4.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-31911 libpcap BPF interpreter calls abort() if it encounters a BPF instruction that ha... |
medium | 5.5 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-31912 libpcap BPF interpreter detects neither reaching the end of the filter program b... |
medium | 5.5 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-6244 libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not... |
medium | 5.5 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86191 SiYuan versions before v3.8.2 contain an information disclosure vulnerability in... |
medium | 4.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86192 SiYuan versions before v3.8.2 fail to properly filter private attribute-view cel... |
medium | 6.5 | — | — | 2026-09-05 | 2026-09-10 |
| CVE-2026-86186 AVideo API fails to enforce rate limits when clients send a bot User-Agent heade... |
medium | 6.5 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86187 WWBN AVideo generates passwords for external-login accounts using rand() instead... |
medium | 5.9 | — | — | 2026-09-05 | 2026-09-10 |
| CVE-2026-15550 The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Au... |
medium | 4.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2025-15647 CDT before 1.4.5 contains an out-of-bounds read vulnerability in the opposedVert... |
medium | 5.5 | — | — | 2026-09-05 | 2026-10-19 |
| CVE-2026-12843 The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in... |
medium | 5.4 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86175 NetBox through 4.7.0 fails to redact sensitive data source backend credentials i... |
medium | 6.5 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86176 NetBox through 4.7.0 fails to properly scope user-private records in REST and Gr... |
medium | 4.3 | — | — | 2026-09-05 | 2026-09-18 |
| CVE-2026-86178 Pixelfed through 0.12.9 fails to validate follower status in StoryComposeControl... |
medium | 5.4 | — | — | 2026-09-05 | 2026-09-23 |
| CVE-2026-86174 Plane through 1.4.2 fails to validate that issues belong to the deploy board's p... |
medium | 4.3 | — | — | 2026-09-05 | 2026-09-16 |
| CVE-2026-86118 gonic versions before 0.22.0 fail to validate administrator privileges in the st... |
medium | 4.3 | — | — | 2026-09-05 | 2026-09-16 |
| CVE-2026-86120 APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability... |
medium | 4.3 | — | — | 2026-09-05 | 2026-09-23 |
| CVE-2026-86122 Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allo... |
medium | 5.0 | — | — | 2026-09-05 | 2026-09-23 |
| CVE-2026-86112 BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favo... |
medium | 5.4 | — | — | 2026-09-05 | 2026-09-10 |
| CVE-2026-86113 BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edi... |
medium | 6.5 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86114 Arcane versions before 2.0.0 fail to properly restrict template operations, allo... |
medium | 6.5 | — | — | 2026-09-05 | 2026-09-23 |
| CVE-2026-86115 Sim before 0.8.14 classifies tool requests as internal based on URL prefix match... |
medium | 5.0 | — | — | 2026-09-05 | 2026-09-23 |
| CVE-2026-86116 Metabase versions before 0.63.1 fail to enforce data analyst permission checks o... |
medium | 6.5 | — | — | 2026-09-05 | 2026-09-24 |
| CVE-2026-86111 BookWyrm through 0.9.1 fails to validate user visibility permissions in the stat... |
medium | 6.5 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-76573 The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to... |
medium | 6.4 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-75018 The Custom Contact Forms plugin for WordPress is vulnerable to authorization byp... |
medium | 4.3 | — | — | 2026-09-05 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.