September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84215 Unauthenticated Broken Access Control in Timetics <= 1.0.61 versions. |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84754 Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions. |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-84755 Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions. |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-81282 Subscriber Cross Site Scripting (XSS) in Product Variations Swatches for WooComm... |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-75602 OpenList a file list program that supports multiple storage. |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-81281 Subscriber Cross Site Scripting (XSS) in Graphene <= 2.9.4 versions. |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-85238 MISP contains a session fixation vulnerability in the CustomAuth authentication... |
medium | 6.8 | — | Misp-project / misp | 2026-09-03 | 2026-09-11 |
| CVE-2026-85239 A vulnerability in MISP's event template handling allowed an authenticated user... |
medium | 6.5 | — | Misp-project / misp | 2026-09-03 | 2026-09-11 |
| CVE-2026-84963 An incorrect numeric conversion in the JSON parsing component of the MongoDB C D... |
medium | 5.3 | — | Mongodb / c driver | 2026-09-03 | 2026-09-22 |
| CVE-2026-84965 An integer wraparound in an allocation size calculation in the BSON library's JS... |
medium | 5.5 | — | Mongodb / c driver | 2026-09-03 | 2026-09-22 |
| CVE-2026-84966 An incorrect numeric type conversion in the BSON document building component of... |
medium | 5.5 | — | Mongodb / c\+\+ driver | 2026-09-03 | 2026-09-22 |
| CVE-2026-84967 A component of the MongoDB extension for Visual Studio Code does not neutralize... |
medium | 4.3 | — | Mongodb / mongodb | 2026-09-03 | 2026-09-09 |
| CVE-2026-84962 An unauthorized user with key vault write access may cause an authorized client... |
medium | 4.2 | — | Mongodb / libmongocrypt | 2026-09-03 | 2026-09-17 |
| CVE-2026-82525 Exterro FTK Imager before 8.3 contains an XML external entity (XXE) injection vu... |
medium | 5.5 | — | — | 2026-09-03 | 2026-09-14 |
| CVE-2026-75035 A flaw was found in Rancher Manager. |
medium | 6.5 | — | Suse / rancher | 2026-09-03 | 2026-09-18 |
| CVE-2026-75036 A security vulnerability was discovered in Fleet's Helm template preprocessing w... |
medium | 4.3 | — | Suse / rancher fleet | 2026-09-03 | 2026-10-07 |
| CVE-2026-50554 Note Mark is an open-source note-taking application. |
medium | 5.3 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-85226 MISP contains an authorization flaw in the OnDemand correlation engine where cor... |
medium | 4.3 | — | Misp-project / misp | 2026-09-03 | 2026-09-10 |
| CVE-2026-85227 MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event... |
medium | 6.1 | — | Misp-project / misp | 2026-09-03 | 2026-09-10 |
| CVE-2026-85230 A persistent unsafe URL injection vulnerability exists in the MISP dashboard But... |
medium | 5.4 | — | Misp-project / misp | 2026-09-03 | 2026-09-10 |
| CVE-2026-85210 Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated... |
medium | 4.3 | — | — | 2026-09-03 | 2026-10-08 |
| CVE-2026-85177 CRMEB through 6.0.0 fails to validate message ownership in the edit_message hand... |
medium | 5.4 | — | — | 2026-09-03 | 2026-09-23 |
| CVE-2026-85135 A security flaw has been discovered in ILIAS up to 9.21/10.9/11.2. |
medium | 6.3 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84970 A numeric truncation weakness exists in the JSON parsing component of the MongoD... |
medium | 5.8 | — | Mongodb / c\+\+ driver | 2026-09-03 | 2026-09-10 |
| CVE-2026-84971 Improper handling of an unexpected value size in the decryption path of a client... |
medium | 6.5 | — | Mongodb / libmongocrypt | 2026-09-03 | 2026-09-17 |
| CVE-2026-71403 A flaw was found in Rancher Manager. |
medium | 6.1 | — | Suse / rancher | 2026-09-03 | 2026-09-18 |
| CVE-2026-63694 Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Imprope... |
medium | 5.0 | — | Dell / smartfabric os10 | 2026-09-03 | 2026-10-14 |
| CVE-2026-56126 pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the... |
medium | 5.4 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-56127 pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the... |
medium | 5.4 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-56128 pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the... |
medium | 5.4 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-35160 Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Imprope... |
medium | 5.0 | — | Dell / smartfabric os10 | 2026-09-03 | 2026-10-14 |
| CVE-2026-84815 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 5.8 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-85167 n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerabili... |
medium | 6.5 | — | N8n / n8n | 2026-09-03 | 2026-10-29 |
| CVE-2026-85170 n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gma... |
medium | 6.5 | — | N8n / n8n | 2026-09-03 | 2026-10-29 |
| CVE-2026-85171 n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerabi... |
medium | 6.5 | — | N8n / n8n | 2026-09-03 | 2026-10-29 |
| CVE-2026-85172 n8n versions before 2.34.1 contain a server-side request forgery vulnerability i... |
medium | 6.4 | — | N8n / n8n | 2026-09-03 | 2026-10-29 |
| CVE-2026-85173 n8n versions before 2.36.2 contain a missing per-project authorization vulnerabi... |
medium | 4.3 | — | N8n / n8n | 2026-09-03 | 2026-10-29 |
| CVE-2026-85161 AVideo through commit c91b5975d contains a cross-site request forgery vulnerabil... |
medium | 4.3 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85162 AVideo through commit c91b5975d contains a cross-site request forgery vulnerabil... |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85163 AVideo through commit c91b5975d contains a server-side request forgery vulnerabi... |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.