September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86437 Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/up... |
high | 7.2 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86439 knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool argu... |
high | 8.8 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86540 knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary... |
high | 7.8 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86711 electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated... |
high | 7.4 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86713 PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in the load... |
high | 7.1 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86718 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a c... |
high | 7.1 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86720 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to val... |
high | 8.1 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86723 AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains an authenticati... |
high | 8.1 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86725 AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing autho... |
high | 7.1 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86728 AVideo through 29.0 contains an authentication bypass vulnerability in plugin/Pl... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86730 Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-la... |
high | 8.8 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-51974 An eval() injection vulnerability in the get_list function in modules/meta_parse... |
high | 8.8 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2021-44320 Parrot AR.Drone version 1 and 2 does not employ a suitable mechanism to prevent... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2022-35499 In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to r... |
high | 7.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-18341 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to corr... |
high | 8.8 | — | Ibm / i | 2026-09-04 | 2026-09-08 |
| CVE-2026-18672 In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation... |
high | 7.5 | — | — | 2026-09-02 | 2026-09-08 |
| CVE-2026-19219 In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity p... |
high | 8.1 | — | — | 2026-09-02 | 2026-09-08 |
| CVE-2026-0799 In BPF instructions that load/store a value from/to a scratch memory register th... |
high | 8.7 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86673 A vulnerability was determined in ningzichun Student Management System up to 987... |
high | 7.3 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86669 A vulnerability was detected in aircheng-org iWebShop-5 up to 5.15. |
high | 7.3 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86287 Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths. |
high | 7.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86159 A flaw has been found in SourceCodester Online Voting System 1.0. |
high | 7.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86162 A vulnerability was determined in SourceCodester Online Voting System 1.0. |
high | 7.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-52691 ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-47625 NVIDIA Triton Inference Server for Linux contains a vulnerability where an attac... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-16497 NVIDIA Triton Inference Server for Linux contains a vulnerability where an attac... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-16028 Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed... |
high | 7.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-16281 The Classified Listing WordPress plugin before 6.1.1 does not verify that the ca... |
high | 7.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-19224 The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a n... |
high | 7.2 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-84934 The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability che... |
high | 8.0 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84935 The HT Menu WordPress plugin before 1.2.7 does not perform any capability or obj... |
high | 8.0 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-76958 SAP Integration Suite does not sufficiently validate XML documents accepted from... |
high | 8.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-85147 SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentia... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85540 DreamMaker developed by Interinfo has a SQL Injection vulnerability. |
high | 8.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-19858 The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2... |
high | 7.5 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-77826 The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which appl... |
high | 8.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-81404 The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape... |
high | 7.1 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-82304 The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user... |
high | 8.6 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-18480 The SureCart WordPress plugin before 4.6.3 does not ensure that the account affe... |
high | 8.8 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-84219 The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the... |
high | 7.5 | — | — | 2026-09-06 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.