September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-91958 FreeRDP versions before 3.31.0 fail to validate MonitorIds array values when par... |
medium | 6.6 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-91956 FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the URBDRC... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-91954 FreeRDP before 3.31.0 contains a null pointer dereference vulnerability in gdi_s... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-91953 FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in n... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-91952 FreeRDP versions before 3.31.0 contain an infinite-loop denial of service in the... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-91951 FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in t... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-91950 FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the rdpdr_... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-91946 FreeRDP versions before 3.31.0 contain an information disclosure vulnerability i... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-91945 FreeRDP versions before 3.31.0 contain an out-of-bounds read vulnerability in sm... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-24 |
| CVE-2026-84470 A flaw was found in Ansible Automation Platform's automation-controller (AWX). |
medium | 6.4 | — | — | 2026-09-01 | 2026-09-24 |
| CVE-2026-71458 URLModificationMiddleware resolves named-URL lookups
against unfiltered Model.o... |
medium | 5.0 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-71460 /api/v2/config/ is protected only by IsAuthenticated. |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-71462 StringListPathField.to_internal_value() calls
os.path.exists() on unbounded use... |
medium | 4.1 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-88015 rclone is a command-line program to sync files and directories to and from diffe... |
medium | 5.3 | — | Rclone / rclone | 2026-09-10 | 2026-09-23 |
| CVE-2026-88014 rclone is a command-line program to sync files and directories to and from diffe... |
medium | 6.3 | — | Rclone / rclone | 2026-09-10 | 2026-09-23 |
| CVE-2026-83530 A user could provide an expression whose string length is longer than the Parser... |
medium | 4.3 | — | Google / common expression language | 2026-09-09 | 2026-09-23 |
| CVE-2026-88013 rclone is a command-line program to sync files and directories to and from diffe... |
medium | 5.3 | — | Rclone / rclone | 2026-09-10 | 2026-09-23 |
| CVE-2026-21113 Improper export of android application components in Visual Voicemail prior to v... |
medium | 5.5 | — | Samsung / visual voicemail | 2026-09-09 | 2026-09-23 |
| CVE-2026-21108 Improper export of android application components in Bixby Touch prior to versio... |
medium | 5.5 | — | Samsung / bixby | 2026-09-09 | 2026-09-23 |
| CVE-2026-21112 Improper input validation in Samsung Tips prior to Android 17 allows local attac... |
medium | 5.5 | — | Samsung / android | 2026-09-09 | 2026-09-23 |
| CVE-2026-21107 Out-of-bounds write in Samsung Notes prior to version 4.4.45.5 allows local atta... |
medium | 5.5 | — | Samsung / notes | 2026-09-09 | 2026-09-23 |
| CVE-2026-77955 In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONE... |
medium | 4.4 | — | Nlnetlabs / unbound | 2026-09-16 | 2026-09-23 |
| CVE-2026-21105 Improper access control in Collection prior to version 1.0.1.14 in Android 15 an... |
medium | 5.5 | — | Samsung / collection | 2026-09-09 | 2026-09-23 |
| CVE-2026-95592 Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versio... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95600 Unauthenticated Sensitive Data Exposure in TrustedLogin Connector <= 2.0.3 versi... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94457 Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions. |
medium | 4.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94498 Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions. |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94671 Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions. |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94682 Contributor Cross Site Scripting (XSS) in Podcast Importer SecondLine <= 1.5.6 v... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95524 Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions. |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95530 Subscriber Cross Site Scripting (XSS) in PixelYourSite – Your smart PIXEL (TAG)... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93709 Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivale... |
medium | 5.3 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-93772 Subscriber Cross Site Scripting (XSS) in wpForo Forum <= 3.1.5 versions. |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94118 Contributor Cross Site Scripting (XSS) in Premium Blocks – Gutenberg Blocks for... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94168 Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.1... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93513 Contributor Insecure Direct Object References (IDOR) in SiteSkite <= 2.1.7 versi... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93529 Contributor Broken Access Control in WSP MCP – AI Agents Connector <= 2.7.0 vers... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93620 Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versio... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-12751 IBM Cloud Pak for Business Automation is vulnerable to HTML injection. |
medium | 5.4 | — | Ibm / cloud pak for business automation | 2026-09-15 | 2026-09-23 |
| CVE-2026-12750 IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripti... |
medium | 5.4 | — | Ibm / cloud pak for business automation | 2026-09-15 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.