September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-69683 Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an auth... |
high | 7.7 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-69716 Improper neutralization of special elements used in an sql command ('sql injecti... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-69724 Missing authorization in Microsoft Office SharePoint allows an authorized attack... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-69804 Time-of-check time-of-use (toctou) race condition in Microsoft Office SharePoint... |
high | 7.5 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-84068 The Quentn WP WordPress plugin before 1.2.15 does not adequately escape a reques... |
high | 8.6 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-62649 A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). |
high | 7.5 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-67367 A vulnerability has been identified in SIMOVE Fleetmanager V3.1 (All versions <... |
high | 8.6 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-3174 The Event Tickets and Registration plugin for WordPress is vulnerable to unautho... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-15667 The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)... |
high | 7.5 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-16960 The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public tem... |
high | 7.5 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-14962 The ELEX WooCommerce Request a Quote WordPress plugin before 2.4.1 does not prop... |
high | 8.6 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-14359 The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Priv... |
high | 8.8 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-75161 An issue in the ugw-restart method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Ser... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-75169 An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solution... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2021-44319 Parrot AR.Drone 1 and AR.Drone 2 are vulnerable to Denial of Service. |
high | 7.5 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-71626 An issue in Invoice Ninja v5.13.24 allows a remote attacker to obtain sensitive... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-75438 Buffer Overflow vulnerability in Open5GS v2.7.7 allows a remote attacker to caus... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-79423 An authenticated remote code execution (RCE) vulnerability in the admin_config.p... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-79426 An arbitrary file deletion vulnerability in the /adminapi/file/video_data_save c... |
high | 7.2 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-86145 PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of... |
high | 8.2 | — | — | 2026-09-05 | 2026-09-09 |
| CVE-2026-79376 An issue in the l2cap_handle_data() function of Bestechnic Co., Ltd BES2300 Blue... |
high | 8.8 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-79377 A heap overflow in the a2dp_decoder_sbc.cpp component of Bestechnic Co., Ltd BES... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-79378 An issue in the btm_acl_handle() function of Bestechnic Co., Ltd BES2300 Bluetoo... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-79575 The JWT signing secret in yfexam-exam v2.0 is derived from the username and the... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-78834 A code execution vulnerability exists in CMSimple 5.22 in the CoAuthors plugin. |
high | 8.8 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-85505 ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmi_oe... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-77104 CommServe contained a path traversal issue affecting information disclosure. |
high | 7.5 | — | Commvault / commvault | 2026-09-08 | 2026-09-09 |
| CVE-2026-77103 CommServe contained an authentication bypass issue affecting access authorizatio... |
high | 7.5 | — | Commvault / commvault | 2026-09-08 | 2026-09-09 |
| CVE-2026-77102 CommServe contained a heap-based buffer overflow issue affecting service availab... |
high | 7.5 | — | Commvault / commvault | 2026-09-08 | 2026-09-09 |
| CVE-2026-77101 CommServe contained a stack-based buffer overflow issue affecting service availa... |
high | 7.5 | — | Commvault / commvault | 2026-09-08 | 2026-09-09 |
| CVE-2026-17470 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of... |
high | 7.5 | — | Ibm / i | 2026-09-04 | 2026-09-09 |
| CVE-2026-77105 CommServe contained a cryptographic signature verification issue affecting privi... |
high | 8.8 | — | Commvault / commvault | 2026-09-08 | 2026-09-09 |
| CVE-2026-14296 When using the Direct XIP
update strategy, the main application image starts oth... |
high | 7.5 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-14957 In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKe... |
high | 7.5 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-18058 The mobile Smart Connect dashboard UI was subject to manipulation
by 3rd party a... |
high | 7.5 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-86242 Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path... |
high | 8.1 | — | — | 2026-09-06 | 2026-09-09 |
| CVE-2026-19651 IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3... |
high | 7.4 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-17499 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary c... |
high | 7.8 | — | Ibm / i | 2026-09-04 | 2026-09-09 |
| CVE-2026-86806 A weakness has been identified in opengeos GeoLibre up to 2.3.0. |
high | 7.3 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-76801 The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart A... |
high | 8.8 | — | — | 2026-09-09 | 2026-09-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.