September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-85454 MOOS core-moos through 10.4.0 contains a buffer overflow vulnerability in CMOOSS... |
medium | 6.1 | — | Themoos / core-moos | 2026-09-03 | 2026-10-14 |
| CVE-2026-85456 MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from... |
medium | 5.5 | — | Mit / moos-ivp | 2026-09-03 | 2026-10-14 |
| CVE-2026-85241 A weakness has been identified in SpecterOps BloodHound up to 9.5.1. |
medium | 6.3 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-9036 IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or impro... |
medium | 5.9 | — | Ibm / netezza performance server | 2026-09-03 | 2026-09-10 |
| CVE-2026-9736 IBM Netezza Software 11.3.0.3 through Interim Fix 002 could allow an unauthorize... |
medium | 4.3 | — | Ibm / netezza performance server | 2026-09-03 | 2026-09-10 |
| CVE-2026-9744 IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or impro... |
medium | 5.9 | — | Ibm / netezza performance server | 2026-09-03 | 2026-09-10 |
| CVE-2026-9745 IBM Netezza Software 11.3.0.3 through Interim Fix 002 has operations that are pe... |
medium | 6.5 | — | Ibm / netezza performance server | 2026-09-03 | 2026-09-10 |
| CVE-2026-82521 parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an outp... |
medium | 5.3 | — | — | 2026-09-03 | 2026-09-24 |
| CVE-2026-84185 A flaw was found in the jwcrypto library, which is used for implementing Javascr... |
medium | 5.9 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-71429 stream-json is a micro-library of stream components for processing JSON and JSON... |
medium | 6.2 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-85044 Use of released resource in Mobile in Google Chrome on on Android prior to 152.0... |
medium | 6.5 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-19795 Qiskit could allow a local attacker to cause a denial of service due to a stack... |
medium | 6.2 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85205 A vulnerability was determined in itsourcecode Online Medicine Delivery System 1... |
medium | 6.3 | — | — | 2026-09-03 | 2026-09-15 |
| CVE-2026-85389 Worklenz before 3.0.0 fails to verify task ownership by organization when resolv... |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-14 |
| CVE-2026-85392 Peppermint through 0.5.5 contains an authorization bypass vulnerability in the G... |
medium | 4.3 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-82298 Incorrect Authorization (CWE-863) in Kibana can lead to denial of service via Ex... |
medium | 4.3 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-82299 Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure v... |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-49455 Waku is the minimal React framework. |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-78593 An insufficiently validated configuration field in Kibana's Cribl integration al... |
medium | 4.3 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-78595 Missing Authorization in Kibana Leading to Information Disclosure / Missing Auth... |
medium | 4.3 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-78596 Missing Authorization in Kibana Leading to Unauthorized Modification of Data / M... |
medium | 4.3 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-84968 An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver m... |
medium | 5.3 | — | Mongodb / php driver | 2026-09-03 | 2026-09-10 |
| CVE-2026-82023 LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authoriz... |
medium | 4.3 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-82024 LearnPress WordPress Plugin before 4.4.6 contains a stored cross-site scripting... |
medium | 5.4 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85308 Authorization Bypass Through User-Controlled Key vulnerability in Brainstorm For... |
medium | 5.3 | — | — | 2026-09-03 | 2026-09-07 |
| CVE-2026-85309 Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allo... |
medium | 5.3 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-85186 A weakness has been identified in itsourcecode Online Medicine Delivery System 1... |
medium | 6.3 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-85302 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-07 |
| CVE-2026-85303 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-85304 Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For... |
medium | 5.3 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-85305 Server-Side Request Forgery (SSRF) vulnerability in SEOPress allows Server Side... |
medium | 5.4 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-85306 Missing Authorization vulnerability in Cascadia Web Services MountDev AI MCP Con... |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-85307 Insertion of Sensitive Information Into Sent Data vulnerability in Kevin Pirnie... |
medium | 5.3 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84849 Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce <= 2.3 versio... |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84769 Unauthenticated Insecure Direct Object References (IDOR) in Business Directory <... |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-07 |
| CVE-2026-84774 Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.11 versions... |
medium | 6.1 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-84762 Unauthenticated Bypass Vulnerability in WP EasyPay <= 4.5.3 versions. |
medium | 5.3 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84766 Unauthenticated Bypass Vulnerability in FluentBooking Pro <= 2.2.1 versions. |
medium | 5.9 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-84767 Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions. |
medium | 5.3 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-84758 Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions. |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-05 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.