September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-82126 The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not... |
low | 2.7 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-84905 The Eventin WordPress plugin before 4.1.24 does not verify a user's capability t... |
low | 2.7 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-84907 The Eventin WordPress plugin before 4.1.24 does not properly authorise order fin... |
low | 3.7 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-92214 A flaw has been found in a2ui-project a2ui up to 0.10.7. |
low | 3.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-91747 Use after free in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote... |
low | 3.1 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91730 Incomplete cleanup in GetUserMedia in Google Chrome prior to 153.0.8010.47 allow... |
low | 3.1 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91723 Race condition in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed... |
low | 3.1 | — | Google / chrome | 2026-09-15 | 2026-09-18 |
| CVE-2026-91708 Race condition in Network in Google Chrome prior to 153.0.8010.47 allowed a remo... |
low | 3.1 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-87284 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
low | 3.2 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87281 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
low | 3.2 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-83369 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
low | 3.1 | — | Oracle / access manager | 2026-09-15 | 2026-09-21 |
| CVE-2026-83413 Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (compo... |
low | 1.9 | — | Oracle / coherence | 2026-09-15 | 2026-09-22 |
| CVE-2026-83414 Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (compo... |
low | 2.5 | — | Oracle / coherence | 2026-09-15 | 2026-09-22 |
| CVE-2026-18425 Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action (Con... |
low | 2.7 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-21 |
| CVE-2026-81922 Concrete CMS before 9.5.3 did not enforce a per-page authorization check when re... |
low | 2.7 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-18 |
| CVE-2026-81923 In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check... |
low | 2.7 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-18 |
| CVE-2026-91957 FreeRDP before 3.31.0 contains a use-after-free vulnerability in the smartcard R... |
low | 3.1 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-88621 OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in... |
low | 2.7 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-91835 A vulnerability was detected in OpenClaw ClawScan up to 0.1.6. |
low | 2.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91836 A flaw has been found in OpenClaw ClawScan up to 0.1.6. |
low | 2.8 | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-25825 An issue was discovered in Keyfactor SignServer before 7.6.0. |
low | 2.7 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-25827 An issue was discovered in Keyfactor SignServer before 7.6.0. |
low | 2.3 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-91926 A flaw was found in gss-ntlmssp. |
low | 3.7 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2025-13166 The SMS OTP flow fails to adequately handle error messages, allowing an attacker... |
low | 3.7 | — | — | 2026-09-15 | 2026-10-14 |
| CVE-2026-91781 A security vulnerability has been detected in GNU Binutils 2.47. |
low | 3.3 | — | Gnu / binutils | 2026-09-15 | 2026-09-16 |
| CVE-2026-91782 A vulnerability was detected in GNU Binutils 2.47. |
low | 3.3 | — | Gnu / binutils | 2026-09-15 | 2026-09-17 |
| CVE-2026-91779 A security flaw has been discovered in GNU Binutils 2.47. |
low | 3.3 | — | Gnu / binutils | 2026-09-15 | 2026-09-16 |
| CVE-2026-91780 A weakness has been identified in GNU Binutils 2.47. |
low | 3.3 | — | Gnu / binutils | 2026-09-15 | 2026-09-16 |
| CVE-2026-91090 A vulnerability was determined in GPAC up to f1219cde. |
low | 3.9 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-86701 Android application "ManabiPocket for Parents" contains an improper access contr... |
low | 2.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-16592 The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization... |
low | 2.7 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-90850 A vulnerability was detected in PHPGurukul Hostel Management System 3.0. |
low | 2.4 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90845 A flaw has been found in PHPGurukul Daily Expense Tracker System 1.1. |
low | 3.5 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90842 A weakness has been identified in PHPGurukul Blood Donor Management System 1.0. |
low | 3.7 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90835 A flaw has been found in michaelliao itranswarp up to 2.19. |
low | 3.5 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-77191 An authenticated supplicant on an adjacent network may bypass intended network a... |
low | 2.6 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-75943 A brief (milliseconds to seconds) traffic leak may occur when an authenticated s... |
low | 2.6 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-75944 A race condition during supplicant re-authentication may leave a stale ACL entry... |
low | 2.6 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-75945 A race condition may cause a supplicant to remain in an authorized state after a... |
low | 2.6 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90825 A vulnerability was found in GPAC 26.07.0. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.