September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-12749 IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripti... |
medium | 5.4 | — | Ibm / cloud pak for business automation | 2026-09-15 | 2026-09-23 |
| CVE-2026-78227 NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulne... |
medium | 6.5 | — | Nlnetlabs / unbound | 2026-09-16 | 2026-09-23 |
| CVE-2026-91963 FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure v... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-23 |
| CVE-2026-91962 FreeRDP before 3.31.0 contains an integer overflow in the audin Apple backends w... |
medium | 6.3 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-23 |
| CVE-2026-91961 FreeRDP before 3.31.0 contains a denial-of-service vulnerability in the URBDRC c... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-23 |
| CVE-2026-81380 Improper neutralization of special elements used in a command ('command injectio... |
medium | 5.9 | — | Microsoft / visual studio code | 2026-09-08 | 2026-09-23 |
| CVE-2026-82720 NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulner... |
medium | 5.9 | — | Nlnetlabs / unbound | 2026-09-16 | 2026-09-23 |
| CVE-2026-54643 CubeCart is an ecommerce software solution. |
medium | 5.4 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-54648 CubeCart is an ecommerce software solution. |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-88020 Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input d... |
medium | 6.1 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-95625 The Tauri updater plugin verifies update binaries using minisign signatures, but... |
medium | 5.9 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-96456 The Reachy Mini Bluetooth service asks a connecting device for a PIN before it w... |
medium | 6.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-6669 Missing upper bound on the key derivation iteration count accepted during SCRAM... |
medium | 5.9 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93618 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93623 Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 v... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94079 Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions. |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94080 Unauthenticated Broken Access Control in MarketKing <= 2.1.70 versions. |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94391 Contributor Cross Site Scripting (XSS) in Ultimate FAQ <= 2.4.14 versions. |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94461 Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions. |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94500 Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94679 Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions. |
medium | 5.4 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94680 Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions. |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95514 Unauthenticated Bypass Vulnerability in Netgsm <= 2.10.0 versions. |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95523 Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions. |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95525 Subscriber Arbitrary File Deletion in WP User Frontend <= 4.3.11 versions. |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95527 Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versio... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95586 Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <=... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95602 Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooC... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-96548 A flaw has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65... |
medium | 5.6 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-92764 OpenCVE versions 2.4.0 before 3.1.0 fails to properly scope the organizations AP... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-91092 The wpForo Forum plugin for WordPress is vulnerable to authorization bypass in a... |
medium | 4.3 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-18439 The Tutor LMS – eLearning and online course solution plugin for WordPress is vul... |
medium | 4.3 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-84618 A permissions issue was addressed with improved validation. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-23 |
| CVE-2026-84619 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 6.1 | — | Apple / macos | 2026-09-14 | 2026-09-23 |
| CVE-2026-84621 An authorization issue was addressed with improved access control. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-23 |
| CVE-2026-84624 A permissions issue was addressed with improved path validation. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-23 |
| CVE-2026-84628 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-23 |
| CVE-2026-61745 InvenTree is an Open Source Inventory Management System. |
medium | 4.3 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-61746 InvenTree is an Open Source Inventory Management System. |
medium | 5.3 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-61747 InvenTree is an Open Source Inventory Management System. |
medium | 4.3 | — | — | 2026-09-21 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.