September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-77968 A flaw was found in hawtio-operator. |
high | 8.2 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-75021 fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignor... |
high | 8.1 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-62648 A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). |
high | 7.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-62650 A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). |
high | 8.8 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-66840 XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Una... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-81302 PALLET CONTROL products contain an incorrect default permission vulnerability, w... |
high | 7.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-14828 Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 version... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-08 |
| CVE-2026-86665 A vulnerability was identified in aircheng-org iWebShop-5 up to 5.15. |
high | 7.3 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86220 A vulnerability was detected in SourceCodester Class and Exam Timetabling System... |
high | 7.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86225 A vulnerability was identified in SourceCodester Class and Exam Timetabling Syst... |
high | 7.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86168 A security flaw has been discovered in code-projects Content Management System 1... |
high | 7.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-13297 IBM Verify Identity Access Advanced Access Control may be vulnerable to an infor... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2025-38352 Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability |
high | 7.8 | Listed | Linux / Kernel | 2025-07-22 | 2026-09-08 |
| CVE-2026-70178 Missing authorization in Microsoft Fabric allows an authorized attacker to eleva... |
high | 8.8 | — | Microsoft / fabric | 2026-09-03 | 2026-09-08 |
| CVE-2026-83959 Substance3D - Sampler is affected by a Heap-based Buffer Overflow vulnerability... |
high | 7.8 | — | Adobe / substance 3d sampler | 2026-09-03 | 2026-09-08 |
| CVE-2026-86221 A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. |
high | 7.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-16649 The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Script... |
high | 7.2 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-19769 The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPr... |
high | 7.2 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-19887 The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injectio... |
high | 8.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-16502 The Live Composer – Free WordPress Website Builder plugin for WordPress is vulne... |
high | 8.8 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-15984 The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting v... |
high | 7.2 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-14444 The WP Fusion (Pro) plugin for WordPress is vulnerable to Privilege Escalation i... |
high | 7.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-78583 Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via... |
high | 8.1 | — | Elastic / kibana | 2026-09-03 | 2026-09-08 |
| CVE-2026-85045 Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote at... |
high | 7.5 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-85048 Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a... |
high | 8.3 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-85049 Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-86306 A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d... |
high | 7.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86295 A vulnerability was found in D-Link DIR-895L A1_102b07. |
high | 8.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86300 A flaw has been found in Tenda AC9 15.03.05.14. |
high | 7.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86282 A weakness has been identified in jaychouchannel Tourism-Management-System up to... |
high | 7.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86290 A weakness has been identified in SourceCodester Online Voting System 1.0. |
high | 7.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86277 A vulnerability has been found in SourceCodester Syllabus-Aligned Learning Manag... |
high | 7.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86214 A vulnerability was determined in Mstfakts College-Management-System. |
high | 7.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86209 A weakness has been identified in SourceCodester Class and Exam Timetabling Syst... |
high | 7.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86180 A vulnerability has been found in code-projects Task Management System In PHP 1.... |
high | 7.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-82684 Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a Mi... |
high | 8.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85051 Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a... |
high | 8.8 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-85053 Improper resource exposure in CacheStorage in Google Chrome prior to 152.0.7977.... |
high | 8.8 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-86492 In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-ten... |
high | 8.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86494 In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthori... |
high | 7.7 | — | — | 2026-09-07 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.