September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-18540 undici's retry interceptor can append the body of a ranged retry response to byt... |
low | 3.7 | — | Nodejs / undici | 2026-09-04 | 2026-09-16 |
| CVE-2026-17483 IBM Db2 Mirror for i 7.4, 7.5, and 7.6 IBM i could allow a local attacker to del... |
low | 3.3 | — | Ibm / db2 mirror for i | 2026-09-04 | 2026-09-10 |
| CVE-2026-85592 phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the ques... |
low | 3.7 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-84066 The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPr... |
low | 3.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85405 A flaw has been found in Eleveo Call Recording Software 9.7.0. |
low | 3.5 | — | — | 2026-09-04 | 2026-10-20 |
| CVE-2026-85406 A vulnerability has been found in Eleveo Quality Management 9.7.0. |
low | 3.5 | — | — | 2026-09-04 | 2026-10-20 |
| CVE-2026-45197 Kernel software installed and running inside a Guest VM may post improper comman... |
low | 2.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85207 A vulnerability was identified in itsourcecode Online Medicine Delivery System 1... |
low | 3.5 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-85052 Out of bounds read in CrashReporting in Google Chrome prior to 152.0.7977.82 all... |
low | 3.1 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-49456 Waku is the minimal React framework. |
low | 3.1 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-84969 A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C... |
low | 3.7 | — | Mongodb / c driver | 2026-09-03 | 2026-09-10 |
| CVE-2026-85022 A vulnerability was identified in langgenius dify 1.13.0. |
low | 3.5 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-85030 A vulnerability has been found in HKUDS AI-Trader up to d03ff6c056b32ced735adf7c... |
low | 3.7 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-84653 Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both... |
low | 3.5 | — | Jenkins / jenkins | 2026-09-02 | 2026-09-15 |
| CVE-2026-63020 A vulnerability exists in an undisclosed BIG-IP Configuration utility page that... |
low | 3.1 | — | F5 / big-ip access policy manager | 2026-09-02 | 2026-09-15 |
| CVE-2026-78600 Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to un... |
low | 3.5 | — | Elastic / elastic cloud on kubernetes | 2026-09-02 | 2026-09-03 |
| CVE-2026-78587 Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of servic... |
low | 3.1 | — | Elastic / fleet server | 2026-09-02 | 2026-09-03 |
| CVE-2026-14326 The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownersh... |
low | 3.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-19698 The GutenKit WordPress plugin before 2.5.1 does not validate or escape style set... |
low | 3.5 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2025-15692 The Icegram Express WordPress plugin before 5.8.6 does not properly escape a lis... |
low | 3.5 | — | — | 2026-09-02 | 2026-10-19 |
| CVE-2023-3360 The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of... |
low | 3.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81168 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal... |
low | 3.7 | — | Captcha Protected Page Project / captcha protected page | 2026-09-02 | 2026-09-09 |
| CVE-2026-81159 Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allow... |
low | 3.7 | — | Centarro / commerce cybersource | 2026-09-02 | 2026-09-16 |
| CVE-2026-81161 Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation... |
low | 3.3 | — | Content Moderation Notifications Project / content moderation notifications | 2026-09-02 | 2026-09-24 |
| CVE-2026-81196 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not pro... |
low | 2.7 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81198 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not pro... |
low | 3.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-77783 The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post... |
low | 3.7 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-77784 The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is... |
low | 2.7 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-77785 The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the reque... |
low | 2.7 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-77787 The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability... |
low | 2.7 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84437 A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. |
low | 3.5 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84438 A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. |
low | 3.5 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84355 Incorrect authorization in Navigation in Google Chrome prior to 152.0.7977.75 al... |
low | 3.1 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84359 Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remot... |
low | 3.1 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84328 Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allo... |
low | 3.1 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84331 Incorrect authorization in Actor in Google Chrome prior to 152.0.7977.75 allowed... |
low | 3.1 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84367 joi is a schema description language and data validator for JavaScript. |
low | 3.7 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84368 joi is a schema description language and data validator for JavaScript. |
low | 3.7 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84310 pypdf is a free and open-source pure-python PDF library. |
low | 3.3 | — | Pypdf Project / pypdf | 2026-09-01 | 2026-10-05 |
| CVE-2026-84311 pypdf is a free and open-source pure-python PDF library. |
low | 3.3 | — | Pypdf Project / pypdf | 2026-09-01 | 2026-10-05 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.