September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-71178 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
low | 3.7 | — | Dell / policy manager for secure connect gateway | 2026-09-23 | 2026-09-26 |
| CVE-2026-77756 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')... |
low | 3.7 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-87848 The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authori... |
low | 3.7 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93528 The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not ver... |
low | 3.7 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-90951 The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind on... |
low | 3.7 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-91077 The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not... |
low | 2.7 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93507 The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict... |
low | 3.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-87069 The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce,... |
low | 3.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-87074 The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-dr... |
low | 3.7 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-84742 The Events Calendar WordPress plugin before 6.17.5 does not check the capability... |
low | 2.7 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-84743 The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object... |
low | 3.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95958 A security flaw has been discovered in JusticeRage Manalyze 1.0.0. |
low | 3.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-18173 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
low | 3.7 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-07 |
| CVE-2026-62364 wlc is a Weblate command-line client using Weblate's REST API. |
low | 2.3 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-95657 A vulnerability was determined in dgtlmoon Changedetection.io up to 0.55.8. |
low | 3.5 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-95818 A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library... |
low | 3.6 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-92706 Dark Reader is an accessibility browser extension that makes web pages colors da... |
low | 3.4 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-81883 radare2 is a UNIX-like reverse engineering framework and command-line toolset. |
low | 3.3 | — | Radare / radare2 | 2026-09-22 | 2026-09-28 |
| CVE-2026-81884 radare2 is a UNIX-like reverse engineering framework and command-line toolset. |
low | 3.3 | — | Radare / radare2 | 2026-09-22 | 2026-09-28 |
| CVE-2026-77637 Cloudreve is a self-hosted file management and sharing system. |
low | 3.8 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95272 A vulnerability was found in dgtlmoon changedetection.io up to 0.60.7. |
low | 3.7 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95270 A flaw has been found in dgtlmoon changedetection.io up to 0.60.7. |
low | 3.7 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-94426 A vulnerability was determined in xuxueli xxl-job up to 3.5.0. |
low | 3.5 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-49449 Joplin is an open source note-taking and to-do application that organises notes... |
low | 2.5 | — | — | 2026-09-21 | 2026-09-28 |
| CVE-2026-85219 Denial-of-Service in Redis module in Thinkst Canary's OpenCanary 0.9.9 allows an... |
low | 3.7 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-91165 Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. |
low | 2.4 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-63416 draw.io is a configurable diagramming and whiteboarding application. |
low | 3.7 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-77166 The emoji field in the page emoji update endpoint does not properly validate use... |
low | 2.4 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-84298 Hatchet is a platform for orchestrating background tasks, AI agents, and durable... |
low | 3.1 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-55060 GoCD is a continuous deliver server. |
low | 3.7 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-85220 A vulnerability in the Thinkst Canary honeypot Redis service allows an unauthent... |
low | 3.7 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94211 A vulnerability has been found in Hyve5 Leantime up to 3.9.8. |
low | 2.4 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94210 A flaw has been found in Hyve5 Leantime up to 3.9.8. |
low | 3.5 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-86802 The To Do List Member WordPress plugin through 1.6 does not have authorisation o... |
low | 3.7 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94150 A security flaw has been discovered in Omega Solution HRM OS up to 20260717. |
low | 2.4 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-94217 A flaw was found in the User-Managed Access (UMA) implementation of Keycloak. |
low | 3.5 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-94218 A flaw was found in the authentication session management of Keycloak, an identi... |
low | 3.1 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94145 A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. |
low | 3.5 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94137 A vulnerability was identified in Hangzhou Shunwang Technology shzh 10.7.2.693. |
low | 3.3 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-94045 A security flaw has been discovered in newbee-ltd newbee-mall up to 1.0.0. |
low | 3.5 | — | — | 2026-09-20 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.