September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86863 pgAdmin 4's Webserver authentication source is intended to accept an identity as... |
critical | 9.8 | — | Pgadmin / pgadmin 4 | 2026-09-17 | 2026-09-21 |
| CVE-2026-91106 HP has identified and remediated multiple externally reported vulnerabilities wi... |
critical | 9.8 | — | Hp / linux imaging and printing | 2026-09-16 | 2026-09-21 |
| CVE-2026-55366 In IP Multimedia Subsystem, there is a possible authentication bypass due to a l... |
critical | 9.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-94098 A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. |
critical | 9.1 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-83197 Vulnerability in the Siebel Apps - Financial Services product of Oracle Siebel C... |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-83149 Vulnerability in Oracle Application Testing Suite. |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-56960 In multiple locations, there is a possible use-after-free due to a logic error i... |
critical | 9.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-83154 Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component... |
critical | 9.1 | — | Oracle / siebel crm | 2026-09-15 | 2026-09-21 |
| CVE-2026-83201 Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone... |
critical | 9.1 | — | Oracle / siebel crm | 2026-09-15 | 2026-09-21 |
| CVE-2026-83202 Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone... |
critical | 9.1 | — | Oracle / siebel crm | 2026-09-15 | 2026-09-21 |
| CVE-2026-93740 A vulnerability was identified in Totolink A3002MU Hh-B20211125.1046. |
critical | 10.0 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-93374 Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.52 all... |
critical | 9.6 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-82187 The Web to Print Online Designer WordPress plugin before 2.15.0 does not validat... |
critical | 9.8 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-93373 Use after free in Extensions in Google Chrome prior to 153.0.8010.52 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-93372 Buffer overflow in WebGL in Google Chrome on on Android prior to 153.0.8010.52 a... |
critical | 9.6 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2024-50492 Improper Control of Generation of Code ('Code Injection') vulnerability in Scott... |
critical | 9.8 | — | Wpplugin / scottcart | 2024-10-28 | 2026-09-21 |
| CVE-2026-86591 The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation... |
critical | 9.8 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-84434 The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in... |
critical | 9.8 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-89274 The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Ex... |
critical | 9.1 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-92229 The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plug... |
critical | 9.1 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-94096 A vulnerability was found in Netcore NBR200V2 1.3.241127.071246. |
critical | 9.9 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-94101 A security vulnerability has been detected in Netcore NBR200V2 1.3.241127.071246... |
critical | 9.9 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-10747 IBM MQ Appliance could allow a remote attacker to cause a denial of service or p... |
critical | 10.0 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-87214 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
critical | 9.1 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-87217 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
critical | 9.1 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-87230 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
critical | 10.0 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-81321 CM2507 IP cameras store configured wireless network credentials in cleartext wit... |
critical | 9.8 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-61516 Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosur... |
critical | 9.8 | — | — | 2026-09-08 | 2026-09-19 |
| CVE-2026-10858 IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attac... |
critical | 9.9 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-92938 vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to c... |
critical | 9.9 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-92944 vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Nod... |
critical | 9.8 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-92860 A security flaw has been discovered in rcourtman Pulse up to 6.0.4/6.1.0-rc.4. |
critical | 9.1 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-87796 The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbit... |
critical | 9.8 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-62104 Unauthenticated Remote Code Execution (RCE) in Migratico Lite <= 2.6.8 versions. |
critical | 10.0 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-75513 Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-19 |
| CVE-2026-92953 vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and Array... |
critical | 10.0 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-92937 vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in... |
critical | 10.0 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-92948 vm2 versions >= 3.9.6 and <= 3.11.6 are affected by a NodeVM builtin allowlist b... |
critical | 9.9 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-54767 WeGIA is a web manager for charitable institutions. |
critical | 9.1 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-20331 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.6 | — | — | 2026-09-16 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.