September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-90691 A security vulnerability has been detected in 0x4m4 HexStrike AI up to d689933ff... |
high | 8.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90701 A vulnerability was detected in subhajitkhan online-clinic-management-system up... |
high | 7.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90715 A security vulnerability has been detected in marcobambini Gravity up to 0.9.7. |
high | 7.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90787 A vulnerability was identified in Soarkey StudentManagement up to e08f7f1d5015af... |
high | 7.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90789 A weakness has been identified in itsourcecode Leave Management System 1.0. |
high | 7.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-86741 Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field bef... |
high | 8.5 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-14 |
| CVE-2026-86750 Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not validate company assignment a... |
high | 7.7 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-14 |
| CVE-2026-86538 knowns versions before 0.30.0 contain a path traversal vulnerability in the POST... |
high | 7.5 | — | — | 2026-09-07 | 2026-09-14 |
| CVE-2026-85612 OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery v... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-14 |
| CVE-2026-85625 sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the objec... |
high | 8.1 | — | — | 2026-09-04 | 2026-09-14 |
| CVE-2026-85200 The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all... |
high | 7.5 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-73313 XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerabilit... |
high | 8.1 | — | Xenforo / xenforo | 2026-09-08 | 2026-09-14 |
| CVE-2026-84889 IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-09-10 | 2026-09-14 |
| CVE-2026-86093 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker... |
high | 7.5 | — | Ibm / db2 | 2026-09-10 | 2026-09-14 |
| CVE-2026-87958 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a deni... |
high | 8.1 | — | Ibm / db2 | 2026-09-10 | 2026-09-14 |
| CVE-2026-78132 strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribu... |
high | 7.5 | — | Strongswan / strongswan | 2026-09-11 | 2026-09-14 |
| CVE-2026-78133 libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeyi... |
high | 7.5 | — | Strongswan / strongswan | 2026-09-11 | 2026-09-14 |
| CVE-2026-78134 strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and... |
high | 7.1 | — | Strongswan / strongswan | 2026-09-11 | 2026-09-14 |
| CVE-2026-88048 Tesseract is an open source OCR engine. |
high | 7.1 | — | Tesseract-ocr / tesseract ocr | 2026-09-10 | 2026-09-14 |
| CVE-2026-88047 Tesseract is an open source OCR engine. |
high | 7.8 | — | Tesseract-ocr / tesseract ocr | 2026-09-10 | 2026-09-14 |
| CVE-2026-88017 rclone is a command-line program to sync files and directories to and from diffe... |
high | 7.3 | — | Rclone / rclone | 2026-09-10 | 2026-09-14 |
| CVE-2026-88009 Traefik is an open source HTTP reverse proxy and load balancer. |
high | 8.2 | — | Traefik / traefik | 2026-09-10 | 2026-09-14 |
| CVE-2026-88004 Traefik is an open source HTTP reverse proxy and load balancer. |
high | 7.4 | — | Traefik / traefik | 2026-09-10 | 2026-09-14 |
| CVE-2026-80354 Authorization bypass through User-Controlled key vulnerability in Apache Camel K... |
high | 8.1 | — | Apache / camel | 2026-09-10 | 2026-09-14 |
| CVE-2026-69379 Improper link resolution before file access ('link following') in Windows NTFS a... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-14 |
| CVE-2026-69599 Use after free in Windows Remote Desktop Services allows an authorized attacker... |
high | 7.5 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-14 |
| CVE-2026-68884 Heap-based buffer overflow in Windows Kernel allows an authorized attacker to el... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-14 |
| CVE-2026-69501 Untrusted pointer dereference in Windows Secure Kernel Mode allows an authorized... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-14 |
| CVE-2026-69536 Use after free in Windows Remote Desktop Services allows an authorized attacker... |
high | 7.1 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-14 |
| CVE-2026-87921 A vulnerability was identified in Rizwan17 inventory-management-system up to bfe... |
high | 7.3 | — | — | 2026-09-09 | 2026-09-14 |
| CVE-2026-77827 Maono Link 3.8.13 MaonoAiServices Windows service allows local privilege escalat... |
high | 7.1 | — | — | 2026-09-08 | 2026-09-14 |
| CVE-2026-15451 The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privile... |
high | 8.8 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-71809 Authentication Bypass via Hardcoded Master Verification Code vulnerability in Si... |
high | 8.1 | — | — | 2026-09-09 | 2026-09-14 |
| CVE-2026-71612 Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 a... |
high | 8.4 | — | — | 2026-09-09 | 2026-09-14 |
| CVE-2026-58611 Improper authorization in XBox Gaming Services allows an authorized attacker to... |
high | 7.8 | — | Microsoft / xbox gaming services | 2026-09-08 | 2026-09-14 |
| CVE-2026-69293 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-14 |
| CVE-2026-69738 Integer overflow or wraparound in Windows Biometric Service allows an authorized... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-14 |
| CVE-2026-69826 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-14 |
| CVE-2026-75631 Photoshop Desktop is affected by an out-of-bounds write vulnerability that could... |
high | 7.8 | — | Adobe / photoshop | 2026-09-08 | 2026-09-14 |
| CVE-2026-86819 Waves Central for macOS contains a local privilege escalation in the privileged... |
high | 7.1 | — | — | 2026-09-08 | 2026-09-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.