September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-69904 Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an auth... |
low | 3.5 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-48707 InstantCMS is a free and open source content management system. |
low | 3.1 | — | — | 2026-09-08 | 2026-09-11 |
| CVE-2026-84389 A url redirection to untrusted site ('open redirect') vulnerability in Fortinet... |
low | 3.1 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-84392 A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet For... |
low | 2.7 | — | — | 2026-09-08 | 2026-10-29 |
| CVE-2026-86644 A vulnerability was determined in star7th showdoc up to 3.9.1. |
low | 3.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-73317 XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP... |
low | 2.7 | — | Xenforo / xenforo | 2026-09-08 | 2026-09-11 |
| CVE-2026-73318 XenForo before 2.3.13 contains a missing authorization vulnerability in the forc... |
low | 3.8 | — | Xenforo / xenforo | 2026-09-08 | 2026-09-14 |
| CVE-2026-33920 A cross-site request forgery vulnerability was discovered in the login functiona... |
low | 3.5 | — | — | 2026-09-08 | 2026-10-15 |
| CVE-2026-76960 SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cr... |
low | 3.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-76961 SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cr... |
low | 3.5 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-58234 SAP Process Integration (SOAP Adapter) allows a privileged user to send speciall... |
low | 2.2 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86505 In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked pr... |
low | 3.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86501 In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be writt... |
low | 2.8 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86503 In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could tr... |
low | 3.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86491 In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project an... |
low | 3.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86485 In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed f... |
low | 3.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86486 In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed... |
low | 3.7 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86487 In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed re... |
low | 3.1 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86422 ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability i... |
low | 3.3 | — | Imagemagick / imagemagick | 2026-09-07 | 2026-10-29 |
| CVE-2026-86424 ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (... |
low | 2.5 | — | Imagemagick / imagemagick | 2026-09-07 | 2026-10-29 |
| CVE-2026-86301 A vulnerability has been found in code-projects Hospital Information System 1.0. |
low | 3.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2025-52652 HCL MyXalytics was affected by Content Spoofing Vulnerability. |
low | 3.5 | — | — | 2026-09-07 | 2026-10-19 |
| CVE-2025-52657 HCL MyXalytics was affected by Potential DOS Vulnerability. |
low | 3.5 | — | — | 2026-09-07 | 2026-10-19 |
| CVE-2025-52651 HCL MyXalytics was affected by Improper Input validation Vulnerability. |
low | 3.5 | — | — | 2026-09-07 | 2026-10-19 |
| CVE-2026-86231 A security flaw has been discovered in mwiede jsch up to 2.28.5. |
low | 3.7 | — | — | 2026-09-06 | 2026-09-11 |
| CVE-2026-86227 A weakness has been identified in valkey-io valkey up to 9.0.5/9.1.1. |
low | 3.1 | — | — | 2026-09-06 | 2026-09-09 |
| CVE-2026-86226 A security flaw has been discovered in Projectwolds Online Attendance System 1.0... |
low | 3.5 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2021-48006 PocketMine-MP before 4.0.3 does not perform case-insensitive matching when remov... |
low | 3.3 | — | — | 2026-09-06 | 2026-10-08 |
| CVE-2026-86181 A vulnerability was found in code-projects Task Management System 1.0. |
low | 3.5 | — | — | 2026-09-06 | 2026-09-09 |
| CVE-2025-15614 ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW dec... |
low | 3.3 | — | — | 2026-09-05 | 2026-10-19 |
| CVE-2026-84926 The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access... |
low | 2.7 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84927 The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient autho... |
low | 2.7 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84225 The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to... |
low | 2.2 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84745 The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-publi... |
low | 2.7 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-78150 The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership... |
low | 2.7 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-81348 The My Private Site WordPress plugin before 4.2.3 does not apply its site-privac... |
low | 3.7 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2025-15693 The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a dire... |
low | 2.7 | — | — | 2026-09-05 | 2026-10-19 |
| CVE-2025-15694 The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and e... |
low | 3.5 | — | — | 2026-09-05 | 2026-10-19 |
| CVE-2026-86141 xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewPa... |
low | 3.3 | — | Xmlsoft / libxml2 | 2026-09-05 | 2026-09-15 |
| CVE-2026-85704 A security flaw has been discovered in ramon-victor freegpt-webui up to 098db3df... |
low | 3.7 | — | — | 2026-09-04 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.