September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-97879 A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. |
medium | 5.3 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-97884 A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5d... |
medium | 6.3 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-97895 A vulnerability was determined in krayin laravel-crm up to 2.2.5. |
medium | 6.3 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-15273 The Automatic.css plugin for WordPress is vulnerable to Stored Cross-Site Script... |
medium | 6.4 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100877 A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project up to... |
medium | 4.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100878 A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. |
medium | 6.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100883 A flaw has been found in Krayin laravel-crm up to 2.2.5. |
medium | 6.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100884 A vulnerability has been found in Krayin laravel-crm up to 2.2.5. |
medium | 4.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100887 A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Manage... |
medium | 6.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100892 A vulnerability was found in aligungr UERANSIM up to 3.3.0. |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100895 A security flaw has been discovered in Trusted Domain Project OpenARC up to 1.0.... |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100898 A vulnerability was detected in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3... |
medium | 6.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100899 A flaw has been found in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/... |
medium | 6.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100906 A vulnerability was detected in Eyeplus 57.0.0.0308. |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101004 A security vulnerability has been detected in notionnext-org NotionNext up to 4.... |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101010 A vulnerability was identified in aaPanel BaoTa up to 11.8.0. |
medium | 4.7 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101011 A security flaw has been discovered in aaPanel BaoTa up to 11.8.0. |
medium | 4.7 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101035 A flaw has been found in aligungr UERANSIM up to 3.3.0. |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101036 A vulnerability has been found in FLB-Music FLB-Music-Player 1.1.8/1.1.9/1.2.0/1... |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101055 A security flaw has been discovered in Thinkware U3000 up to 1.02.04. |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100890 A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101016 A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2. |
medium | 6.5 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101017 A vulnerability was found in Trusted Domain Project OpenDMARC up to 1.4.2. |
medium | 6.5 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-97869 A flaw has been found in langchain4j up to 1.5.3-beta10/1.11.10-beta18/1.18.1-be... |
medium | 4.1 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-85274 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
medium | 6.5 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-85289 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
medium | 6.5 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-85291 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
medium | 6.5 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-85292 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
medium | 4.8 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-85293 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
medium | 4.8 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-77247 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
medium | 6.5 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-28 |
| CVE-2026-82915 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
medium | 6.5 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82969 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 5.4 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-87752 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82326 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 4.1 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82381 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 5.4 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82382 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.1 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-86507 Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remo... |
medium | 6.1 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101068 A security flaw has been discovered in dbgate up to 7.3.1. |
medium | 6.5 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100722 vm2 before 3.12.2 does not apply host-side Promise rejection handling in the san... |
medium | 6.8 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2024-53922 An issue was discovered in the buffer queue driver in Samsung Automotive Process... |
medium | 5.7 | — | — | 2026-09-14 | 2026-09-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.