September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-96601 A vulnerability was detected in Abdurrab5 online-makeup-store. |
high | 7.3 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96602 A flaw has been found in Abdurrab5 online-makeup-store. |
high | 7.3 | — | — | 2026-09-23 | 2026-09-29 |
| CVE-2026-75887 A flaw was found in the OpenShift console. |
high | 7.5 | — | — | 2026-09-23 | 2026-10-23 |
| CVE-2026-81208 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow an authenticated user to... |
high | 7.7 | — | Ibm / datastage on cloud pak for data | 2026-09-23 | 2026-10-06 |
| CVE-2026-81536 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 7.7 | — | Ibm / datastage on cloud pak for data | 2026-09-23 | 2026-10-06 |
| CVE-2026-81537 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-23 | 2026-10-06 |
| CVE-2026-19125 The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication B... |
high | 8.1 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-80412 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-23 | 2026-10-06 |
| CVE-2026-80425 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-23 | 2026-10-06 |
| CVE-2026-96556 A flaw has been found in Neethuharii CafeManagement. |
high | 7.3 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-6730 IBM Concert 1.0.0 through 3.0.0 is vulnerable to a buffer overflow, caused by im... |
high | 7.8 | — | Ibm / concert | 2026-09-23 | 2026-09-28 |
| CVE-2026-6794 IBM Concert 1.0.0 through 3.0.0 has a double free vulnerability that exists due... |
high | 7.8 | — | Ibm / concert | 2026-09-23 | 2026-09-28 |
| CVE-2026-6935 IBM Concert 1.0.0 through 3.0.0 invokes operating system commands without fully... |
high | 7.8 | — | Ibm / concert | 2026-09-23 | 2026-09-29 |
| CVE-2026-75886 A flaw was found in openshift/console. |
high | 7.2 | — | — | 2026-09-23 | 2026-10-01 |
| CVE-2026-80379 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-23 | 2026-10-06 |
| CVE-2026-67232 RabbitMQ is a messaging and streaming broker. |
high | 7.5 | — | Broadcom / rabbitmq server | 2026-09-23 | 2026-10-19 |
| CVE-2026-67404 RabbitMQ is a messaging and streaming broker. |
high | 7.4 | — | Broadcom / rabbitmq server | 2026-09-23 | 2026-10-19 |
| CVE-2026-67405 RabbitMQ is a messaging and streaming broker. |
high | 8.1 | — | Broadcom / rabbitmq server | 2026-09-23 | 2026-10-19 |
| CVE-2026-96826 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96889 A flaw was found in librsvg. |
high | 7.8 | — | — | 2026-09-23 | 2026-10-29 |
| CVE-2026-94183 Arc Search for Android before version 1.12.10 does not display a fullscreen noti... |
high | 7.4 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-86065 Klever-Go is the Go implementation of the Klever blockchain protocol. |
high | 7.5 | — | — | 2026-09-23 | 2026-09-29 |
| CVE-2026-85475 A flaw was found in the Ansible Automation Platform automation controller. |
high | 7.2 | — | — | 2026-09-23 | 2026-10-16 |
| CVE-2026-86064 Klever-Go is the Go implementation of the Klever blockchain protocol. |
high | 8.6 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-84714 A flaw was found in the automation-controller input-validation
guard sanitize_j... |
high | 7.1 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-84683 A flaw was found in Red Hat Ansible Automation Platform's automation-
controller... |
high | 8.7 | — | — | 2026-09-23 | 2026-09-25 |
| CVE-2026-84691 A flaw was found in Red Hat Ansible Automation Platform's automation-
controller... |
high | 8.7 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-84706 A flaw was found in Ansible Automation Platform's automation-controller. |
high | 7.6 | — | — | 2026-09-23 | 2026-09-26 |
| CVE-2026-66079 RabbitMQ is a messaging and streaming broker. |
high | 7.5 | — | Broadcom / rabbitmq server | 2026-09-23 | 2026-10-19 |
| CVE-2026-66070 RabbitMQ is a messaging and streaming broker. |
high | 8.8 | — | Broadcom / rabbitmq server | 2026-09-23 | 2026-10-19 |
| CVE-2026-96541 A denial-of-service flaw was found in gnome-remote-desktop. |
high | 7.5 | — | — | 2026-09-23 | 2026-10-14 |
| CVE-2026-95603 Shop manager PHP Object Injection in Reycob Product Import Export <= 2.3.0 versi... |
high | 7.2 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95604 Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions. |
high | 7.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95528 Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booste... |
high | 7.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95529 Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1... |
high | 7.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95590 Subscriber SQL Injection in Tainacan <= 1.2.0 versions. |
high | 7.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95593 Editor SQL Injection in Ultimeter <= 3.0.8 versions. |
high | 7.6 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95515 Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions. |
high | 7.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95522 Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions. |
high | 7.6 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95513 Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar fo... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.