September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-52767 YesWiki is a wiki system written in PHP. |
high | 8.2 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-52769 YesWiki is a wiki system written in PHP. |
high | 8.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-52770 YesWiki is a wiki system written in PHP. |
high | 7.5 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-52771 YesWiki is a wiki system written in PHP. |
high | 8.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-52775 YesWiki is a wiki system written in PHP. |
high | 8.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-83595 AVideo contains a cross-site request forgery vulnerability in plugin/API/set.jso... |
high | 8.1 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84187 AVideo contains a missing authentication vulnerability in plugin/Live/on_publish... |
high | 8.2 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84201 appium-mcp-server through 0.1.61 fails to validate or normalize file paths in th... |
high | 7.1 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84202 ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files,... |
high | 8.8 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84203 Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user c... |
high | 8.1 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-8712 Wyoming before 1.10.2 contains a server-side request forgery vulnerability that... |
high | 8.3 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-45221 Konga before 2.1.0 contains a privilege escalation vulnerability that allows low... |
high | 7.8 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-71981 Cypht before 2.12.2 contains a PHP object injection vulnerability that allows au... |
high | 8.8 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84208 AVideo through version 29.0 contains an unauthenticated SQL injection vulnerabil... |
high | 7.5 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84476 WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-F... |
high | 7.5 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84478 WWBN AVideo contains a path traversal vulnerability in the API get_api_login_cod... |
high | 7.3 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84482 WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulner... |
high | 8.8 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-84695 BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in... |
high | 8.7 | — | — | 2026-09-02 | 2026-09-08 |
| CVE-2026-85155 WWBN AVideo contains a SQL injection vulnerability in the sort column parameter... |
high | 7.5 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85160 AVideo through commit c91b5975d contains a cross-site request forgery and path t... |
high | 8.1 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85164 WWBN AVideo through commit c91b5975d contains a server-side request forgery vuln... |
high | 7.1 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85174 SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an ac... |
high | 8.8 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85175 SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in th... |
high | 8.8 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-71963 Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote c... |
high | 8.8 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85388 Worklenz through 3.0.0 fails to properly validate the sort-field query parameter... |
high | 8.1 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85609 Openpanel before 2.3.0 contains an unauthenticated full-read server-side request... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85613 OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unau... |
high | 8.2 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85614 OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery v... |
high | 8.6 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-86716 A vulnerability was determined in Cesanta mJS up to 1.26. |
high | 7.3 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-80112 PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 10... |
high | 7.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-80114 PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 10... |
high | 7.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-80116 PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 10... |
high | 7.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-80117 PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 10... |
high | 7.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-80119 PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 10... |
high | 7.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85452 MOOS ui-moos through 50b9c6c contains a buffer overflow vulnerability in ScopeTa... |
high | 8.8 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85584 SiYuan versions before v3.8.2 contain a denial of service vulnerability in the p... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85585 SiYuan before v3.8.2 contains an unbounded resource consumption vulnerability in... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85599 Grav Shortcode Core before 6.2.5 contains stored cross-site scripting vulnerabil... |
high | 7.2 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85604 Grav before 2.0.18 (affected versions <= 2.0.17) contains a remote code executio... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-86188 AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerabili... |
high | 7.2 | — | — | 2026-09-05 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.