September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86498 In JetBrains YouTrack before 2025.3.160480,
2026.1.14047 pUT requests on link s... |
high | 7.7 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-82712 Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a cr... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-77393 In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shi... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85399 A security flaw has been discovered in code-projects Hospital Information System... |
high | 7.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-77233 The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin... |
high | 7.2 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-77830 The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vu... |
high | 7.2 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-6377 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 7.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-31431 Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability |
high | 7.8 | Listed | Linux / Kernel | 2026-04-22 | 2026-09-08 |
| CVE-2026-71375 Improper restriction of XML external entity reference vulnerability in Cosminexu... |
high | 7.4 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-82302 Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configurati... |
high | 8.1 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-86298 A security flaw has been discovered in SourceCodester Class and Exam Timetabling... |
high | 7.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86272 A vulnerability was determined in Beijing Meite Software Technology U+Smart Enjo... |
high | 7.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86211 A flaw has been found in rabindralamsal inventory-management-system 1.0.0. |
high | 7.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86223 A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.... |
high | 7.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86160 A vulnerability has been found in SourceCodester Online Voting System 1.0. |
high | 7.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-77263 The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin... |
high | 7.2 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-19051 Plaintext storage of a password vulnerability in Menulux Software Inc. |
high | 7.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-19080 Observable response discrepancy vulnerability in Menulux Software Inc. |
high | 7.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-18198 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-19205 Observable response discrepancy vulnerability in GastroMenum GastroMenum Web Pan... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85649 (Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open pa... |
high | 7.9 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85094 The Canva Android App before 2.376.0 did not restrict the headers returned to an... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85012 Improper neutralization of special elements used in an OS command (CWE-78) in th... |
high | 8.0 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85028 Creation of a temporary file in a directory with insecure permissions in the FPG... |
high | 7.8 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85654 Improper neutralization of special elements used in a template engine in the CDK... |
high | 7.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85656 An OS command injection issue in the log4j-cve-2021-44228-hotpatch package in Am... |
high | 7.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85781 Unverified ownership of a storage access point in the volume deletion component... |
high | 8.7 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85786 Improper handling of highly compressed data in Amazon ion-java before 1.12.1 mig... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-81270 Apache Allura: exposure of non-public information via search. |
high | 7.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-9331 The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable... |
high | 7.1 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-85702 A security vulnerability has been detected in ramon-victor freegpt-webui up to 0... |
high | 7.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-86303 A vulnerability was determined in 92181 markdown up to 058cab0cb7fb245a0ccc6b844... |
high | 7.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-12483 The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type U... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-18406 The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plug... |
high | 7.2 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-78438 The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scrip... |
high | 7.2 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-81543 The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Pri... |
high | 8.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-83625 The Contact Form by Supsystic plugin for WordPress is vulnerable to Stored Cross... |
high | 7.2 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-18056 The HivePress Authentication plugin for WordPress is vulnerable to Authenticatio... |
high | 7.5 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-48888 Allocation of Resources Without Limits or Throttling vulnerability in Automattic... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-81781 Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce... |
high | 7.1 | — | — | 2026-09-08 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.