September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-73461 On affected EOS platforms with AAA-based gRPC authorization enabled for OpenConf... |
high | 8.0 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-73464 On affected platforms running Arista EOS with gRPC Network Management Interface... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-2380 On affected platforms running Arista EOS with OpenConfig-related services (i.e.,... |
high | 7.4 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-73439 On affected platforms running Arista EOS, if OpenConfig is configured and runnin... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-84408 QND contains an improper access control vulnerability in a named pipe, which may... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-88263 XikeStor Layer3 switches miss authentication for downloading configuration data. |
high | 7.5 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-27561 A high-privileged remote attacker can exploit a command injection vulnerability... |
high | 7.2 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-27562 A high-privileged remote attacker can exploit a command injection vulnerability... |
high | 7.2 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-27563 A high-privileged remote attacker can exploit a command injection vulnerability... |
high | 7.2 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-27564 A high-privileged remote attacker can exploit a command injection vulnerability... |
high | 7.2 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-27554 A low-privileged remote attacker can exploit a command injection vulnerability i... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-27555 A low-privileged remote attacker can exploit a local file inclusion vulnerabilit... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-27556 A low-privileged remote attacker can exploit a local file inclusion vulnerabilit... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-27557 An unauthenticated remote attacker can exploit a path traversal vulnerability in... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-27558 A low-privileged remote attacker can exploit a command injection vulnerability i... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-27559 A low-privileged remote attacker can exploit a command injection vulnerability i... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-27560 A high-privileged remote attacker can exploit a command injection vulnerability... |
high | 7.2 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-27547 A low-privileged remote attacker can exploit a command injection vulnerability i... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-27548 A low-privileged remote attacker can exploit a command injection vulnerability i... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-27549 A low-privileged remote attacker can exploit a command injection vulnerability i... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-27550 A low-privileged remote attacker can exploit a command injection vulnerability i... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-27551 A low-privileged remote attacker can exploit a command injection vulnerability i... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-27552 A low-privileged remote attacker can exploit improper authorization in the /inde... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-79708 GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 bef... |
high | 8.5 | — | Gitlab / gitlab | 2026-09-16 | 2026-09-28 |
| CVE-2026-1168 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.... |
high | 7.5 | — | Gitlab / gitlab | 2026-09-16 | 2026-09-28 |
| CVE-2025-14871 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.... |
high | 7.5 | — | Gitlab / gitlab | 2026-09-16 | 2026-10-14 |
| CVE-2026-85530 The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a do... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-85569 The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether... |
high | 7.2 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-86444 The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied val... |
high | 7.1 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-84829 The Optimole WordPress plugin before 4.2.12 does not properly escape a user supp... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-76552 The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the t... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-78472 The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not sanitise... |
high | 8.6 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-74926 The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns... |
high | 7.1 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-76550 The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a use... |
high | 7.2 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-76551 The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which... |
high | 7.2 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-89063 The Online Scheduling and Appointment Booking System – Bookly plugin for WordPre... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-78088 The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plu... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-18595 The WP-Lister Lite for eBay plugin for WordPress is vulnerable to Stored Cross-S... |
high | 7.2 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-86108 Insufficient validation of inputs supplied through affected VeloCloud Edge manag... |
high | 8.0 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-92299 @jitsi/electron-sdk before 10.0.5 exposes getDesktopSources() via contextBridge... |
high | 7.4 | — | — | 2026-09-16 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.