September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-94487 Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <... |
high | 8.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94174 Administrator SQL Injection in Email Log <= 2.63 versions. |
high | 7.6 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94176 Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions. |
high | 7.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94179 Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 v... |
high | 7.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94181 An address bar spoofing issue in affected versions of Arc could allow an attacke... |
high | 7.4 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-94124 Contributor SQL Injection in WP EasyCart <= 5.9.4 versions. |
high | 8.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93622 Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 version... |
high | 7.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93773 Contributor SQL Injection in Mollie Forms <= 2.11.0 versions. |
high | 8.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93774 Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.002... |
high | 7.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93526 Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions. |
high | 7.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93527 Contributor SQL Injection in Live Copy Paste for Elementor <= 1.5.10 versions. |
high | 8.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-84486 A flaw was found in Red Hat Ansible Automation Platform's automation-
controller... |
high | 8.2 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-84499 A flaw was found in Red Hat Ansible Automation Platform's automation-
controller... |
high | 7.7 | — | — | 2026-09-23 | 2026-09-26 |
| CVE-2026-82356 Imprivata EAM <=26.2.6 lacks the ability to rotate its RSA key pair after deploy... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-25 |
| CVE-2026-77601 OpenC3 COSMOS provides the functionality needed to send commands to and receive... |
high | 8.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-77423 JLine is a Java library for handling console input. |
high | 7.5 | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-76648 CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes =
(IsAuthentic... |
high | 8.5 | — | — | 2026-09-23 | 2026-10-16 |
| CVE-2026-77394 OpenC3 COSMOS provides the functionality needed to send commands to and receive... |
high | 7.6 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-77422 JLine is a Java library for handling console input. |
high | 7.5 | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-75131 NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escala... |
high | 7.8 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-76086 Formie is a Craft CMS plugin for creating forms. |
high | 8.5 | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-76087 Formie is a Craft CMS plugin for creating forms. |
high | 8.2 | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-76089 Formie is a Craft CMS plugin for creating forms. |
high | 7.7 | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-59990 Jawn is an open source JSON parser. |
high | 7.5 | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-61695 Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. |
high | 7.5 | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-61814 Jawn is an open source JSON parser. |
high | 7.5 | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-86926 A heap buffer overflow vulnerability in the FileMaker Server database engine blo... |
high | 7.8 | — | Claris / filemaker server | 2026-09-23 | 2026-10-06 |
| CVE-2026-86938 A DLL hijacking vulnerability in the FileMaker Pro installer for Windows allowed... |
high | 7.3 | — | Claris / filemaker pro | 2026-09-23 | 2026-10-05 |
| CVE-2026-96775 MLflow's dspy flavor, versions >= 2.0, applies the MLFLOW_ALLOW_PICKLE_DESERIALI... |
high | 8.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-96804 MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOW_ALLOW_PIC... |
high | 8.8 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96808 In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper... |
high | 7.4 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96756 orval versions before 8.30.0 contain a code injection vulnerability in the @orva... |
high | 8.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-96656 Plex Media Server External Control of File Name or Path Vulnerability |
high | 7.2 | Listed | Plex / Media Server | 2026-09-23 | 2026-10-21 |
| CVE-2026-96513 A security flaw has been discovered in Neethuharii CafeManagement. |
high | 7.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-96514 A weakness has been identified in Neethuharii CafeManagement. |
high | 7.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95843 Moquette is a lightweight Java MQTT broker. |
high | 7.5 | — | Moquette / moquette | 2026-09-23 | 2026-09-25 |
| CVE-2026-95844 Moquette is a lightweight Java MQTT broker. |
high | 7.5 | — | Moquette / moquette | 2026-09-23 | 2026-09-29 |
| CVE-2026-95845 Moquette is a lightweight Java MQTT broker. |
high | 7.5 | — | Moquette / moquette | 2026-09-23 | 2026-09-25 |
| CVE-2026-95846 Moquette is a lightweight Java MQTT broker. |
high | 7.5 | — | Moquette / moquette | 2026-09-23 | 2026-09-25 |
| CVE-2026-95847 Moquette is a lightweight Java MQTT broker. |
high | 7.5 | — | Moquette / moquette | 2026-09-23 | 2026-09-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.