September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-16787 The Live Composer – Free WordPress Website Builder plugin for WordPress is vulne... |
medium | 6.4 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-17589 The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generi... |
medium | 4.9 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-12747 The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cr... |
medium | 6.4 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-19032 jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supp... |
medium | 5.3 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-67395 A path traversal vulnerability exists in Sage Employee Self Service’s custom log... |
medium | 5.9 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-102138 An authenticated administrator on a node with an optional, separately licensed g... |
low | 3.3 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-13 |
| CVE-2026-103436 apcupsd through 3.14.14 discloses uninitialized stack memory in getupsvar() in s... |
low | 3.7 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-100268 In JetBrains YouTrack before 2026.2.19197 project administrators could read comm... |
low | 2.7 | — | Jetbrains / youtrack | 2026-09-30 | 2026-10-01 |
| CVE-2026-100270 In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users... |
low | 2.7 | — | Jetbrains / youtrack | 2026-09-30 | 2026-10-02 |
| CVE-2026-100271 In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpo... |
low | 2.7 | — | Jetbrains / youtrack | 2026-09-30 | 2026-10-02 |
| CVE-2026-100264 In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could b... |
low | 2.7 | — | Jetbrains / youtrack | 2026-09-30 | 2026-10-02 |
| CVE-2026-27085 Shop manager Content Injection in Astra WordPress Theme <= 4.13.12 versions. |
low | 2.7 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102587 A flaw was found in Moodle. |
low | 2.7 | — | Moodle / moodle | 2026-09-30 | 2026-10-01 |
| CVE-2026-102583 A flaw was found in Moodle. |
low | 2.7 | — | Moodle / moodle | 2026-09-30 | 2026-10-01 |
| CVE-2026-94297 The Media Library Organizer WordPress plugin before 2.1.4 does not verify that t... |
low | 2.7 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-88791 The Safe Redirect Manager WordPress plugin before 2.3.0 does not properly valida... |
low | 3.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-82127 The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not... |
low | 3.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102844 A weakness has been identified in gedelumbung HospitalManagement up to c2d455437... |
low | 2.7 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-71189 An attacker can construct a request that, if issued by another application user,... |
low | 3.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-69662 The application uses unsafe functions that allow execution of inline scripts and... |
low | 3.7 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102621 A vulnerability was identified in Freedesktop Poppler up to 26.08.0. |
low | 3.3 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102620 A vulnerability was determined in Freedesktop Poppler 26.06.0/26.07.0/26.08.0. |
low | 3.3 | — | — | 2026-09-29 | 2026-10-02 |
| CVE-2026-76736 A buffer overflow vulnerability exists in the underlying operating system of HPE... |
low | 3.3 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-76737 An authenticated path traversal vulnerability exists in the command line interfa... |
low | 3.0 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-76738 A buffer overflow vulnerability exists in the API endpoint of HPE Networking Ins... |
low | 2.7 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102319 Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.92 allowed a... |
low | 3.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102311 Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037... |
low | 3.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102315 Uninitialized resource in Media in Google Chrome on on Windows prior to 154.0.80... |
low | 3.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102822 Russh is a Rust SSH client and server library. |
low | 3.7 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102825 Russh is a Rust SSH client and server library. |
low | 3.7 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-95359 Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037... |
low | 3.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95324 Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.57 allowed a... |
low | 3.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95312 Information leak in Passwords in Google Chrome prior to 154.0.8037.57 allowed a... |
low | 3.1 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95316 Unchecked return value in Performance in Google Chrome prior to 154.0.8037.57 al... |
low | 2.9 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95317 Incorrect authorization in MediaCapture in Google Chrome prior to 154.0.8037.57... |
low | 3.1 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95302 Incorrect authorization in WebAPKs in Google Chrome on on Android prior to 154.0... |
low | 2.9 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95308 Integer overflow in Metrics in Google Chrome prior to 154.0.8037.57 allowed a re... |
low | 3.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-92223 Joomla! |
low | 3.8 | — | Joomla / joomla\! | 2026-09-29 | 2026-10-06 |
| CVE-2026-90916 Joomla! |
low | 2.7 | — | Joomla / joomla\! | 2026-09-29 | 2026-10-06 |
| CVE-2026-77696 Issue summary: SM2 signature generation uses non-constant-time arithmetic
on sec... |
low | 3.7 | — | Openssl / openssl | 2026-09-29 | 2026-10-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.