September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92972 SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthen... |
high | 8.6 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92959 vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and... |
high | 7.1 | — | — | 2026-09-17 | 2026-09-21 |
| CVE-2026-92961 vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayB... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-21 |
| CVE-2026-92970 HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project fi... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92954 vm2 is a sandbox library for running untrusted JavaScript in Node.js. |
high | 8.6 | — | — | 2026-09-17 | 2026-09-21 |
| CVE-2026-92958 vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. |
high | 8.5 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-92950 vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that a... |
high | 8.6 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92942 vm2 before 3.11.7 (affected versions <= 3.11.6) does not enforce the VM({ timeou... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-90887 Unauthenticated Cross Site Scripting (XSS) in WP Inventory Manager <= 2.5.4 vers... |
high | 7.1 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-90986 Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statisti... |
high | 7.1 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-81442 Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Im... |
high | 8.1 | — | Dell / openmanage server administrator | 2026-09-17 | 2026-10-06 |
| CVE-2026-78295 Unauthenticated Cross Site Request Forgery (CSRF) in Xagio SEO <= 7.1.0.43 versi... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-66631 Administrator SQL Injection in MC Woocommerce Wishlist <= 1.9.21 versions. |
high | 7.6 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-66625 Administrator SQL Injection in WC Vendors Marketplace <= 2.7.2.1 versions. |
high | 7.6 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-66626 Editor SQL Injection in SKT Addons for Elementor <= 4.0 versions. |
high | 7.6 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-66628 Shop manager SQL Injection in WP-Lister Lite for eBay <= 3.8.11 versions. |
high | 7.6 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-66630 Administrator SQL Injection in PublishPress Series <= 3.1.3 versions. |
high | 7.6 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-66624 Administrator SQL Injection in WPMasterToolKit <= 2.22.0 versions. |
high | 7.6 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-66618 Administrator SQL Injection in WP Maps <= 4.9.9 versions. |
high | 7.6 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-66619 Administrator SQL Injection in Newsletters <= 4.18 versions. |
high | 7.6 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-66580 Contributor SQL Injection in Product Feed Manager <= 7.12.0 versions. |
high | 8.5 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-66571 Unauthenticated Cross Site Request Forgery (CSRF) in Asset CleanUp: Page Speed B... |
high | 7.1 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-92918 admin3 through 3.0.0 persists user session tokens in the audit log event body wh... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92919 admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload h... |
high | 8.1 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-81481 Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Im... |
high | 7.5 | — | Dell / openmanage server administrator | 2026-09-17 | 2026-10-02 |
| CVE-2026-92925 A flaw was found in Redis community. |
high | 7.1 | — | — | 2026-09-17 | 2026-10-28 |
| CVE-2026-92913 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptograp... |
high | 7.4 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92914 AVideo LoginControl contains an authentication bypass vulnerability in the PGP s... |
high | 8.1 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92915 WWBN AVideo through commit e01e41ecc (no patched version available) contains a b... |
high | 7.3 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92916 Grav is a flat-file CMS. |
high | 7.5 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-92917 Grav is a flat-file CMS. |
high | 7.5 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-81480 Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Sta... |
high | 7.2 | — | Dell / openmanage server administrator | 2026-09-17 | 2026-10-02 |
| CVE-2026-81477 Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Hea... |
high | 7.2 | — | Dell / openmanage server administrator | 2026-09-17 | 2026-10-06 |
| CVE-2026-81474 Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Hea... |
high | 7.8 | — | Dell / openmanage server administrator | 2026-09-17 | 2026-10-01 |
| CVE-2026-92903 Improper input validation in Snowflake CLI versions prior to 3.27.0 allowed unsa... |
high | 8.2 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-66269 Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use... |
high | 7.5 | — | Dell / openmanage server administrator | 2026-09-17 | 2026-10-06 |
| CVE-2026-81438 Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains Use o... |
high | 7.5 | — | Dell / openmanage server administrator | 2026-09-17 | 2026-10-01 |
| CVE-2026-86320 A flaw was found in flatpak-builder where Git hooks are not disabled when applyi... |
high | 7.8 | — | — | 2026-09-17 | 2026-10-30 |
| CVE-2026-86801 The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-87963 The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize... |
high | 8.6 | — | — | 2026-09-17 | 2026-09-20 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.