September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-96764 A weakness has been identified in kvcache-ai mooncake up to 0.3.12/0.3.14-rc1. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-86867 Cinnamon's Kotaemon (all versions up to and including v0.12.0) multi-user chat i... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-84718 A flaw was found in the Ansible Automation Platform automation-controller. |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-84720 A flaw was found in the Ansible Automation Platform automation-controller. |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-81645 Out-of-bounds read vulnerability in the graphics module. |
medium | 5.9 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-3253 The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to u... |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96445 A flaw was found in the Conditional OTP authenticator of Keycloak, an identity a... |
medium | 6.8 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96545 An out-of-bounds heap read flaw was found in GIMP's TIM image loader. |
medium | 4.4 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-92905 ZohoCorp ManageEngine EventLog Analyzer and Log360 before build 13071 were vulne... |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97181 GPM LIGHT developed by ezGlobal has a Sensitive Data Exposure vulnerability. |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-84091 The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-74991 The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment... |
medium | 6.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-80338 The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on... |
medium | 6.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-82195 The 10Web Booster WordPress plugin before 2.34.0 does not restrict access to the... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-82849 The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user ma... |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-82850 The Masteriyo LMS WordPress plugin before 3.4.2 does not restrict access to quiz... |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-88845 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not per... |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-88846 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not che... |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-88847 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not ver... |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-89002 The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitize... |
medium | 6.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-89005 The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise... |
medium | 6.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-93662 The Events Manager WordPress plugin before 7.4.5 does not force the scope of its... |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96773 A weakness has been identified in Intelliants Subrion CMS up to 4.2.1. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96774 A vulnerability was found in SPON Communications IP Network Audio Device XC-9603... |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96880 A vulnerability was found in TaleLin lin-cms-spring-boot up to 0.2.1. |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96881 A vulnerability was determined in TaleLin lin-cms-spring-boot up to 0.2.1. |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96884 A security flaw has been discovered in MantisZip up to 0.4.5. |
medium | 6.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96892 A flaw has been found in Edimax BR-6428nC 1.16. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-15731 The WP Multilang – Translation and Multilingual Plugin plugin for WordPress is v... |
medium | 6.4 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-16302 The Spectra Legacy – Gutenberg Blocks plugin for WordPress is vulnerable to Sens... |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-94102 A flaw has been found in WuzhiCMS up to 4.1.0. |
medium | 4.3 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-78806 An issue in Matter Standard Specification-Implementation gap v1.5.1 Matter Proje... |
medium | 5.5 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-94050 A vulnerability has been found in D-Link DIR-X1860Z up to 1.0.2.220120.165402. |
medium | 4.3 | — | — | 2026-09-20 | 2026-09-24 |
| CVE-2026-94092 A vulnerability was detected in dmlc dgl up to 2.1.0. |
medium | 5.5 | — | — | 2026-09-20 | 2026-09-24 |
| CVE-2026-94035 A vulnerability was determined in SourceCodester Drug Recommendation System 1.0. |
medium | 4.3 | — | — | 2026-09-20 | 2026-09-24 |
| CVE-2026-94040 A flaw has been found in vas3k TaxHacker up to 0.8.5. |
medium | 5.3 | — | — | 2026-09-20 | 2026-09-24 |
| CVE-2026-79320 Stencil core 4.43.5 contains a DOM-based cross-site scripting (XSS) vulnerabilit... |
medium | 6.1 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2025-43200 Apple Multiple Products Unspecified Vulnerability |
medium | 4.2 | Listed | Apple / Multiple Products | 2025-06-16 | 2026-09-24 |
| CVE-2026-91960 FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's Stream_Ens... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-91959 FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rts_read_... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.