September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-17553 The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in ve... |
high | 7.2 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-84293 The Repeater Fields for Gravity Forms plugin for WordPress is vulnerable to Stor... |
high | 7.2 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-76009 The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable... |
high | 8.1 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-14989 The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is... |
high | 7.2 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-86539 knowns through 0.33.0 contains a server-side request forgery vulnerability in th... |
high | 7.2 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86544 knowns versions before 0.30.0 contain an authorization bypass vulnerability wher... |
high | 8.1 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86292 A vulnerability was detected in SourceCodester Simple Traffic Offense System 1.0... |
high | 7.3 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86297 A vulnerability was identified in D-Link DIR-605 B1v202WWB03. |
high | 8.1 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86276 A flaw has been found in SourceCodester Syllabus-Aligned Learning Management & E... |
high | 7.3 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86222 A vulnerability has been found in SourceCodester Class and Exam Timetabling Syst... |
high | 7.3 | — | — | 2026-09-06 | 2026-09-09 |
| CVE-2026-6431 The User Profile Builder – Beautiful User Registration Forms, User Profiles & Us... |
high | 7.2 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-17627 IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacke... |
high | 7.1 | — | Langflow / langflow | 2026-09-04 | 2026-09-09 |
| CVE-2026-78543 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.... |
high | 7.5 | — | Ibm / app connect enterprise | 2026-09-04 | 2026-09-09 |
| CVE-2026-86210 A security vulnerability has been detected in SourceCodester Class and Exam Time... |
high | 7.3 | — | — | 2026-09-06 | 2026-09-09 |
| CVE-2026-18851 Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0... |
high | 8.8 | — | Ivanti / endpoint manager mobile | 2026-09-08 | 2026-09-09 |
| CVE-2026-86733 Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive dire... |
high | 7.2 | — | Snipeitapp / snipe-it | 2026-09-08 | 2026-09-09 |
| CVE-2026-76196 Photoshop Mobile is affected by a Session Fixation vulnerability that could resu... |
high | 7.4 | — | Adobe / photoshop mobile | 2026-09-08 | 2026-09-09 |
| CVE-2026-77109 Adobe Commerce is affected by an Incorrect Authorization vulnerability that coul... |
high | 8.6 | — | Adobe / commerce | 2026-09-08 | 2026-09-09 |
| CVE-2026-77774 Adobe Commerce is affected by an Incorrect Authorization vulnerability that coul... |
high | 8.6 | — | Adobe / commerce | 2026-09-08 | 2026-09-09 |
| CVE-2026-83961 ColdFusion is affected by an Improper Authentication vulnerability that could re... |
high | 7.1 | — | Adobe / coldfusion | 2026-09-03 | 2026-09-09 |
| CVE-2026-78254 The ftp and scp tasks of Apache Ant can download files from a remote server. |
high | 7.4 | — | Apache / ant | 2026-09-07 | 2026-09-09 |
| CVE-2026-86738 Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Cust... |
high | 8.7 | — | Snipeitapp / snipe-it | 2026-09-08 | 2026-09-09 |
| CVE-2026-86502 In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the... |
high | 8.4 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86504 In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation be... |
high | 7.8 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86479 In JetBrains YouTrack before 2026.2.18788,
2026.1.14055,
2025.3.161254 missing... |
high | 8.1 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-83527 An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10... |
high | 8.1 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-81963 Microsoft Windows Link Following Vulnerability |
high | 7.8 | Listed | Microsoft / Windows | 2026-09-08 | 2026-09-09 |
| CVE-2026-76967 SAP NetWeaver Business Client does not perform sufficient validation when proces... |
high | 7.8 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-66767 SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenti... |
high | 7.7 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-45200 Software installed and run as a non-privileged user may conduct improper GPU dri... |
high | 7.8 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-19633 PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked u... |
high | 8.8 | — | — | 2026-09-06 | 2026-09-09 |
| CVE-2026-69764 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-09-09 |
| CVE-2026-20502 In vdec, there is a possible out of bounds write due to a missing bounds check. |
high | 8.4 | — | Mediatek / mt2718 firmware | 2026-09-07 | 2026-09-09 |
| CVE-2026-20501 In vdec, there is a possible out of bounds write due to a heap buffer overflow. |
high | 8.4 | — | Mediatek / mt2718 firmware | 2026-09-07 | 2026-09-09 |
| CVE-2026-19300 IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain se... |
high | 7.5 | — | Langflow / langflow | 2026-09-04 | 2026-09-08 |
| CVE-2026-19305 IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain se... |
high | 7.5 | — | Langflow / langflow | 2026-09-04 | 2026-09-08 |
| CVE-2026-19306 IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read a... |
high | 7.7 | — | Langflow / langflow | 2026-09-04 | 2026-09-08 |
| CVE-2026-81832 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.... |
high | 7.7 | — | Ibm / app connect enterprise | 2026-09-04 | 2026-09-08 |
| CVE-2026-61699 nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. |
high | 8.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-63464 nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. |
high | 7.7 | — | — | 2026-09-04 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.