September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-81790 Missing Authorization vulnerability in Viszt Péter Csomagpontok és szállítási cí... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-81798 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-81806 Server-Side Request Forgery (SSRF) vulnerability in John Darrel Hide My WP Ghost... |
high | 7.2 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-84817 Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.1 versions... |
high | 7.1 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-84818 Unauthenticated Cross Site Scripting (XSS) in Open User Map <= 1.4.50 versions. |
high | 7.1 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-84820 Unauthenticated Cross Site Scripting (XSS) in Unlimited Elements For Elementor (... |
high | 7.1 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-19118 A time-of-check time-of-use race condition vulnerability was identified in GitHu... |
high | 7.5 | — | Github / enterprise server | 2026-09-01 | 2026-09-08 |
| CVE-2026-76851 A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Ente... |
high | 8.8 | — | Github / enterprise server | 2026-09-01 | 2026-09-08 |
| CVE-2026-80753 In the Linux kernel, the following vulnerability has been resolved:
ovpn: run d... |
high | 8.4 | — | — | 2026-09-03 | 2026-09-07 |
| CVE-2026-84756 Subscriber Privilege Escalation in WCFM Membership <= 2.11.11 versions. |
high | 7.1 | — | — | 2026-09-03 | 2026-09-07 |
| CVE-2026-84763 Unauthenticated Cross Site Scripting (XSS) in RTMKit <= 2.1.5 versions. |
high | 7.1 | — | — | 2026-09-03 | 2026-09-07 |
| CVE-2026-84778 Unauthenticated Denial of Service Attack in Migrate Guru – Site Migration & Clon... |
high | 7.5 | — | — | 2026-09-03 | 2026-09-07 |
| CVE-2026-81295 Unauthenticated Cross Site Scripting (XSS) in Under Construction <= 5.82 version... |
high | 7.1 | — | — | 2026-09-03 | 2026-09-07 |
| CVE-2026-85225 A vulnerability was identified in code-projects Doctor Appointment System 1.0. |
high | 7.3 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-85137 A security vulnerability has been detected in SeaCMS up to 13.6. |
high | 7.3 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-84812 Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 vers... |
high | 7.1 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-84847 Unauthenticated Broken Access Control in Quick Event Manager <= 9.17 versions. |
high | 7.5 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-81773 Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension... |
high | 7.1 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-84841 A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. |
high | 7.3 | — | — | 2026-09-02 | 2026-09-05 |
| CVE-2026-52022 An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a deni... |
high | 7.5 | — | Kamailio / kamailio | 2026-09-01 | 2026-09-04 |
| CVE-2026-52130 llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/jso... |
high | 7.5 | — | Ggml / llama.cpp | 2026-09-01 | 2026-09-04 |
| CVE-2026-52131 llama.cpp b5693 and before has a Reachable Assertion via the gguf_reader::read f... |
high | 7.5 | — | Ggml / llama.cpp | 2026-09-01 | 2026-09-04 |
| CVE-2026-58566 Dell PowerStore, an Incorrect Authorization vulnerability. |
high | 8.8 | — | — | 2026-09-01 | 2026-09-04 |
| CVE-2023-20576 Insufficient Verification of Data Authenticity in AGESA™ may allow an attacker t... |
high | 7.7 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2023-20577 A heap overflow in SMM module may allow an attacker with access to a second vuln... |
high | 7.4 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-52132 llama.cpp through commit 97f06e9, when started with the --reranking flag, allows... |
high | 7.5 | — | Ggml / llama.cpp | 2026-09-01 | 2026-09-04 |
| CVE-2026-85208 A security flaw has been discovered in itsourcecode Online Medicine Delivery Sys... |
high | 7.3 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-85380 A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d... |
high | 7.3 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-85398 A vulnerability was identified in code-projects Hospital Information System 1.0. |
high | 7.3 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-57777 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-78604 Incorrect Permission Assignment for Critical Resource (CWE-732) in Elastic Agent... |
high | 7.8 | — | Elastic / elastic agent | 2026-09-02 | 2026-09-04 |
| CVE-2026-56855 Previously, after a channel has been established, a malicious peer could send cr... |
high | 7.5 | — | Golang / crypto | 2026-09-02 | 2026-09-04 |
| CVE-2026-78662 Previously, a channel registered in the mux's chanList is not usable until it is... |
high | 7.5 | — | Golang / crypto | 2026-09-02 | 2026-09-04 |
| CVE-2026-85187 A security vulnerability has been detected in itsourcecode Online Medicine Deliv... |
high | 7.3 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-85512 A security flaw has been discovered in SourceCodester Class and Exam Timetabling... |
high | 7.3 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-84394 fast-uri accepts a host that contains an unbalanced or misplaced authority brack... |
high | 7.5 | — | Openjsf / fast-uri | 2026-09-03 | 2026-09-04 |
| CVE-2026-85397 A vulnerability was determined in code-projects Hospital Information System 1.0. |
high | 7.3 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-85403 A flaw has been found in code-projects Doctor Appointment System 1.0. |
high | 7.3 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-85379 A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53... |
high | 7.3 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-73764 Vulnerabilities have been identified in the operating system of AOS-CX switches... |
high | 7.1 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.