September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-90563 A vulnerability was determined in maliangnansheng bbs-springboot 3.0.0. |
low | 3.5 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90771 joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerabil... |
low | 3.7 | — | — | 2026-09-13 | 2026-09-24 |
| CVE-2026-90773 procs through 0.14.12 fails to sanitize escape sequences in process command line... |
low | 3.2 | — | — | 2026-09-13 | 2026-09-23 |
| CVE-2026-90508 A security flaw has been discovered in Chengdu Qilu Technology Ludashi 6.1026.47... |
low | 3.4 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90503 A flaw has been found in Chengdu Qilu Technology Ludashi 6.1026.4715.714. |
low | 2.3 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90502 A vulnerability was detected in stilleshan ServerStatus 1.0/2.0. |
low | 3.5 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-86407 The User Registration & Membership WordPress plugin before 5.2.8 does not verify... |
low | 3.7 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90497 A vulnerability was determined in Fengoffice Feng Office up to 3.11.13.11. |
low | 3.5 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90489 A vulnerability was identified in Xuxueli xxl-job up to 3.5.0. |
low | 3.5 | — | — | 2026-09-13 | 2026-09-18 |
| CVE-2026-79300 SEP sesam before 5.2.0.24 mishandles User Authorization with MFA. |
low | 3.5 | — | — | 2026-09-12 | 2026-09-22 |
| CVE-2026-82851 The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or... |
low | 2.7 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-84025 The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on seve... |
low | 2.2 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-90453 A file-upload handler redirects the authenticated client's browser to a URL take... |
low | 3.5 | — | — | 2026-09-11 | 2026-10-02 |
| CVE-2026-90455 A prior update that raised a bundled HTTP client library to a version remediatin... |
low | 3.7 | — | — | 2026-09-11 | 2026-10-02 |
| CVE-2026-11765 Improper neutralization of argument delimiters in a command ('argument injection... |
low | 3.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-86779 The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-d... |
low | 2.7 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2025-15695 The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not... |
low | 3.5 | — | — | 2026-09-11 | 2026-10-14 |
| CVE-2026-89162 In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adv... |
low | 3.3 | — | Pcre / pcre2 | 2026-09-11 | 2026-09-16 |
| CVE-2026-89151 Forgejo before 16.0.4 allows use of restricted API tokens for unintended access... |
low | 3.5 | — | — | 2026-09-11 | 2026-09-22 |
| CVE-2026-78127 libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory afte... |
low | 3.7 | — | Strongswan / strongswan | 2026-09-11 | 2026-09-14 |
| CVE-2026-78131 strongSwan 4.2.0 through 6.0.7 has a missing release of memory after its effecti... |
low | 3.7 | — | Strongswan / strongswan | 2026-09-11 | 2026-09-14 |
| CVE-2026-78124 strongSwan 5.0.2 through 6.0.7 allows PKCS#7 certificate enumeration in the open... |
low | 3.7 | — | Strongswan / strongswan | 2026-09-11 | 2026-09-14 |
| CVE-2026-45761 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
low | 3.3 | — | Oisf / suricata | 2026-09-10 | 2026-09-16 |
| CVE-2026-87876 Two case-insensitive comparisons on request-derived usernames outside the main a... |
low | 3.0 | — | — | 2026-09-09 | 2026-10-21 |
| CVE-2026-46460 Dell PowerScale OneFS, versions 9.5.0.0 through 9.7.1.15, versions 9.8.0.0 throu... |
low | 3.5 | — | Dell / powerscale onefs | 2026-09-09 | 2026-09-16 |
| CVE-2026-79942 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
low | 3.4 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-79944 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
low | 3.4 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-79693 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
low | 3.4 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-11 |
| CVE-2026-79732 Dell Secure Connect Gateway (SCG) 5.0 Appliance, versions prior to 5.36.00.xx, c... |
low | 3.7 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-79736 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
low | 3.7 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-79690 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
low | 3.7 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-79729 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
low | 3.7 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-14 |
| CVE-2026-86763 Snipe-IT versions >= 7.0.12 and <= 8.6.3 contain an authorization bypass in the... |
low | 3.5 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-86744 Snipe-IT 8.6.3 and earlier (and develop pre-release commits prior to the fix) co... |
low | 2.2 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-18 |
| CVE-2026-86740 Snipe-IT before 8.7.0 fails to check the return value of Storage::delete() in Up... |
low | 3.8 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-14 |
| CVE-2026-86203 PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when... |
low | 3.7 | — | — | 2026-09-09 | 2026-10-08 |
| CVE-2026-80169 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
low | 3.3 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-79966 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
low | 3.3 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-79727 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
low | 3.3 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-80239 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
low | 2.4 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.