September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92463 yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-89029 Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged user... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-89031 Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged user... |
medium | 5.4 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92567 TDuck survey form through version 5.0 contains an authorization bypass vulnerabi... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92569 Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in fo... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92603 ContiNew Admin through 4.1.0 contains an authorization bypass vulnerability in t... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92605 IRIS through 2.4.29 fails to properly validate case authorization in comment lis... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92759 SecObserve versions before 1.59.1 contain an information disclosure vulnerabilit... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92781 Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pol... |
medium | 6.3 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-93015 BlueKitchen BTstack through 1.8.2 fails to validate the peer-reported endpoint c... |
medium | 6.3 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-94112 mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use... |
medium | 6.8 | — | — | 2026-09-20 | 2026-09-24 |
| CVE-2026-88339 A NULL pointer dereference vulnerability exists in the gf_sg_vrml_field_clone()... |
medium | 5.5 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-95812 ClipBucket v5 before 5.5.3-#182 contains a reflected cross-site scripting vulner... |
medium | 6.1 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-95815 OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persi... |
medium | 6.3 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-92928 OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains a hardcode... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-92929 OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 trusts an X-Forward... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-92930 OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 uses an administrat... |
medium | 6.2 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96599 Isotope eCommerce through 2.9.10 derives order identifiers from uniqid() instead... |
medium | 5.9 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96600 Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in... |
medium | 5.5 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96674 alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit a... |
medium | 4.4 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96676 A vulnerability was identified in Fast FAC1900R 20190827_2.0.2. |
medium | 6.3 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96680 A vulnerability was detected in ByteDance Coze Scraper Extension up to 2.0.2. |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96739 A flaw has been found in SEMCMS up to 4.2. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97056 SigNoz versions from v0.98.0 up to (but not including) v0.143.0, when configured... |
medium | 6.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97232 A vulnerability was determined in volotat Anagnorisis up to 0.4.2. |
medium | 6.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97321 A vulnerability has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.... |
medium | 6.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97323 A vulnerability was determined in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.... |
medium | 6.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-48540 Krayin CRM through 2.2.6 contains a stored client-side template injection vulner... |
medium | 5.4 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-90775 PostGIS address_standardizer through 3.7.0 fails to validate the Weight paramete... |
medium | 6.5 | — | — | 2026-09-13 | 2026-09-24 |
| CVE-2026-92775 Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-88341 A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .y... |
medium | 5.5 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-88384 OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing... |
medium | 5.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-57843 NetBSD contains an information disclosure vulnerability in mm_open() within sys/... |
medium | 5.5 | — | — | 2026-09-11 | 2026-09-24 |
| CVE-2026-89021 MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the c... |
medium | 6.9 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-92750 Harness through 3.3.0 omits access control validation in the infrastructure prov... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92770 Harbor through 2.15.2 fails to properly restrict the q query parameter filtering... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-97224 A vulnerability was detected in Excalidraw up to 0.18.1. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96745 Deserialization of untrusted data in the command monitoring support of the Mongo... |
medium | 5.6 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96746 An out-of-bounds write in the connection-monitoring logic of the MongoDB C Drive... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96747 The client-side field level encryption support in the MongoDB Python Driver can... |
medium | 5.0 | — | — | 2026-09-24 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.