September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86075 n8n is an open source workflow automation platform. |
high | 7.5 | — | N8n / n8n | 2026-09-08 | 2026-09-11 |
| CVE-2026-86074 n8n is an open source workflow automation platform. |
high | 7.1 | — | N8n / n8n | 2026-09-08 | 2026-09-11 |
| CVE-2026-86073 n8n is an open source workflow automation platform. |
high | 7.6 | — | N8n / n8n | 2026-09-08 | 2026-09-11 |
| CVE-2026-74925 The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update... |
high | 7.2 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-85677 The Gutenverse News WordPress plugin before 3.3.3 does not restrict the extra HT... |
high | 8.8 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-8301 Improper neutralization of special elements used in an OS command ('OS command i... |
high | 7.8 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-8303 Incorrect privilege assignment vulnerability in TUBITAK BILGEM Software Technolo... |
high | 7.8 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-7863 Improper neutralization of special elements used in an OS command ('OS command i... |
high | 8.4 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89176 WeenyGenius, a computer lab management system developed by Howyar Technologies,... |
high | 8.8 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89177 WeenyGenius, a computer lab management system by Howyar Technologies, has a Use... |
high | 8.8 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89178 WeenyGenius, a computer lab management system by Howyar Technologies, has an Ori... |
high | 8.8 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89174 Smart Video Intercom System developed by Kingdom Communication Associated has a... |
high | 7.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-73785 A potential security vulnerability in HPE IceWall Federation Agent and Proxy cou... |
high | 7.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-86083 n8n is an open source workflow automation platform. |
high | 8.8 | — | N8n / n8n | 2026-09-08 | 2026-09-11 |
| CVE-2026-57161 PJSIP is a free and open source multimedia communication library written in C. |
high | 8.2 | — | Teluu / pjsip | 2026-09-04 | 2026-09-11 |
| CVE-2026-57159 PJSIP is a free and open source multimedia communication library written in C. |
high | 7.5 | — | Teluu / pjsip | 2026-09-04 | 2026-09-11 |
| CVE-2026-89243 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a s... |
high | 8.1 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89250 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an... |
high | 7.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89253 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a s... |
high | 8.7 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89255 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored... |
high | 8.7 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-81821 The vulnerability, if exploited, could allow a miscreant with read access to PIM... |
high | 8.4 | — | — | 2026-09-08 | 2026-09-11 |
| CVE-2026-81822 The vulnerability, if exploited, could allow a miscreant with read access to PIM... |
high | 8.4 | — | — | 2026-09-08 | 2026-09-11 |
| CVE-2026-81754 The Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner…... |
high | 7.2 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-75777 IBM Aspera Enterprise WebApps 1.0.0 through 1.0.5 could allow a local attacker t... |
high | 8.8 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-18994 A potential improper authorization vulnerability was reported in the Lenovo File... |
high | 7.1 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-19136 A potential command injection vulnerability was reported in the Tianxi AI Agent... |
high | 7.8 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-15462 The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via t... |
high | 7.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-11813 A potential improper permissions vulnerability was reported in the Lenovo Filez... |
high | 7.8 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-73784 A potential security vulnerability in HPE IceWall products could be exploited to... |
high | 8.8 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-77106 Cvlaunchd contained a missing authorization issue affecting command execution au... |
high | 8.8 | — | Commvault / commvault | 2026-09-08 | 2026-09-11 |
| CVE-2026-77091 DataCube contained a path traversal issue affecting security feature enforcement... |
high | 7.8 | — | Commvault / commvault | 2026-09-08 | 2026-09-11 |
| CVE-2026-77097 Private Metrics Server contained a missing authentication condition affecting me... |
high | 8.2 | — | Commvault / commvault | 2026-09-08 | 2026-09-11 |
| CVE-2026-83999 Improper link resolution before file access ('link following') in Windows Resili... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-11 |
| CVE-2026-81789 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 8.6 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-77111 Adobe Commerce is affected by an Incorrect Authorization vulnerability that coul... |
high | 8.7 | — | Adobe / commerce | 2026-09-08 | 2026-09-11 |
| CVE-2026-72941 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-69777 Heap-based buffer overflow in Windows DHCP Client allows an authorized attacker... |
high | 8.0 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-11 |
| CVE-2026-69352 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-85237 A vulnerability in MISP's email-based one-time password (OTP) authentication flo... |
high | 8.1 | — | Misp-project / misp | 2026-09-03 | 2026-09-11 |
| CVE-2026-85236 A cross-site request forgery (CSRF) vulnerability existed in the cullEmptyEvents... |
high | 8.8 | — | Misp-project / misp | 2026-09-03 | 2026-09-11 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.