September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92969 The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is... |
high | 8.1 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-74766 Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-af... |
high | 8.4 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-87079 Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadr... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-87081 Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadrati... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-87082 Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-6922 The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnera... |
high | 7.1 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2025-1281 The BM Content Builder plugin for WordPress is vulnerable to arbitrary file dele... |
high | 8.8 | — | — | 2026-09-22 | 2026-10-14 |
| CVE-2026-91827 The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form fie... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-92438 The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field val... |
high | 8.8 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-94504 Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it wit... |
high | 7.2 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-89412 The TranslatePress – Translate Multilingual sites with AI Translation plugin for... |
high | 7.2 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-12470 The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress i... |
high | 7.2 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-94491 A weakness has been identified in Yonyou KSOA 9.0. |
high | 7.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-93710 Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-93712 Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside publi... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-94425 A vulnerability was found in Moore Threads MTT S80 Driver Package 340.150. |
high | 8.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94623 vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL conne... |
high | 7.5 | — | Vllm / vllm | 2026-09-21 | 2026-09-29 |
| CVE-2026-94624 vLLM through 0.29.0 contains a denial of service vulnerability in P2P KV offload... |
high | 7.5 | — | Vllm / vllm | 2026-09-21 | 2026-09-29 |
| CVE-2026-94626 vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_param... |
high | 7.5 | — | Vllm / vllm | 2026-09-21 | 2026-09-29 |
| CVE-2026-94627 vLLM Mooncake connector through 0.29.0 fails to properly manage GPU KV cache blo... |
high | 7.5 | — | Vllm / vllm | 2026-09-21 | 2026-09-29 |
| CVE-2026-94534 lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInf... |
high | 7.1 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94535 lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the... |
high | 7.1 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94540 DesktopSMS 1.11.0 by MrPear contains an unauthorized access vulnerability that a... |
high | 7.7 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-94622 vLLM versions through 0.29.0 contain a denial of service vulnerability in the NI... |
high | 7.5 | — | Vllm / vllm | 2026-09-21 | 2026-09-29 |
| CVE-2026-79079 An issue in CrossWire Xiphos <= 4.3.2 allows a local attacker to execute arbitra... |
high | 7.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-88738 Jazzware RT1000 Edge webUI v. |
high | 8.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-59814 Joplin is an open source note-taking and to-do application that organises notes... |
high | 7.6 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-55210 Joplin is an open source note-taking and to-do application that organises notes... |
high | 7.4 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-94424 A vulnerability has been found in Moore Threads MTT S80 Driver Package up to 340... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-88409 FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a buffer ov... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-88410 The graph.UDF in FalkorDB (Redis module) v4.20.1 to v4.20.4 is not registered as... |
high | 7.1 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-88411 Improper error handling in the GRAPH.EFFECT component (/effects/effects_apply.c)... |
high | 7.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-88746 idccms V1.70 is vulnerable to Cross Site Scripting (XSS) in /admin/makeDiy_deal.... |
high | 7.1 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-88406 FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack ove... |
high | 7.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-88407 An out-of-bounds read in the node_token_count/relation_token_count component of... |
high | 7.5 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-79316 An improper access control vulnerability exists in x-ui 0.3.2. |
high | 7.6 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-77523 MaxKB is an open-source AI assistant for enterprise. |
high | 7.4 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-73553 Envoy is an open source edge and service proxy designed for cloud-native applica... |
high | 7.5 | — | Envoyproxy / envoy | 2026-09-21 | 2026-10-05 |
| CVE-2026-55105 Joplin is an open source note-taking and to-do application that organises notes... |
high | 7.7 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-49450 Joplin is an open source note-taking and to-do application that organises notes... |
high | 7.1 | — | — | 2026-09-21 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.