September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-90767 Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in t... |
medium | 6.5 | — | — | 2026-09-13 | 2026-09-23 |
| CVE-2026-90782 S2OPC through 1.7.3 contains a null pointer dereference in msg_subscription_publ... |
medium | 5.3 | — | — | 2026-09-13 | 2026-09-23 |
| CVE-2026-90940 novel-plus through 5.3.3 contains an insecure default cache-management password... |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-55073 WeasyPrint helps web developers to create PDF documents. |
medium | 6.2 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-91199 Refly through 1.1.0 contains a server-side request forgery vulnerability in the... |
medium | 5.0 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-91201 DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-23 |
| CVE-2026-91993 Jpom through 2.11.12 fails to validate workspace ownership when resolving reposi... |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-92973 ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerab... |
medium | 6.1 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-84810 claude-skill-antivirus fails to analyze executable files when scanning local ski... |
medium | 6.5 | — | — | 2026-09-02 | 2026-09-23 |
| CVE-2026-84811 agentverus-scanner fails to analyze compiled Python bytecode files in companion... |
medium | 6.5 | — | — | 2026-09-02 | 2026-09-23 |
| CVE-2026-82522 libjxl before 0.12 contains an integer underflow vulnerability in the container... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-23 |
| CVE-2026-85650 Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in... |
medium | 5.4 | — | — | 2026-09-04 | 2026-09-23 |
| CVE-2026-95868 A weakness has been identified in AdithyaYelloju Restaurant-Management-System up... |
medium | 6.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95820 A vulnerability was found in anirbandutta9 College-Notes-Gallery up to 8c1cf3d98... |
medium | 6.3 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-92881 A security vulnerability has been detected in vgmstream. |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-93504 A vulnerability has been found in SveltyCMS 0.0.6. |
medium | 6.3 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-93533 A vulnerability was determined in spatie Scotty up to 1.4.4. |
medium | 6.3 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-37603 Improper Restriction of Excessive Authentication Attempts in the administration... |
medium | 6.5 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-61834 scim-patch is a library for applying SCIM patch operations. |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93340 Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerabi... |
medium | 6.8 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-94536 lamp-cloud through 5.10.0 fails to validate the employeeId parameter in the /any... |
medium | 4.3 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-93342 MarketKing plugin for WordPress before 2.1.72 contains a missing authorization v... |
medium | 5.4 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-78441 Out-of-bounds read in Windows OLE DB allows an unauthorized attacker to disclose... |
medium | 6.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-23 |
| CVE-2026-83097 Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component... |
medium | 6.5 | — | Oracle / forms | 2026-09-15 | 2026-09-23 |
| CVE-2026-83109 Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component... |
medium | 5.3 | — | Oracle / forms | 2026-09-15 | 2026-09-23 |
| CVE-2026-95897 A security vulnerability has been detected in Dask up to 2026.8.0. |
medium | 5.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95930 A security vulnerability has been detected in iFlytek astron-agent up to 1.0.6. |
medium | 6.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95957 A vulnerability was found in SourceCodester Smart Attendance System with QR Code... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95830 A security flaw has been discovered in theRealSain Pixtream up to 866afd4f0cea81... |
medium | 6.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95833 A weakness has been identified in itsourcecode Leave Management System 1.0. |
medium | 6.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-6831 The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing aut... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-53682 An unauthenticated client can query the Security Domain hosts inventory via GET... |
medium | 5.3 | — | — | 2026-09-01 | 2026-09-23 |
| CVE-2026-5924 The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross... |
medium | 6.4 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95828 A vulnerability was determined in Mstfakts College-Management-System. |
medium | 4.3 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-95928 A security flaw has been discovered in recommenders-team recommenders up to 1.2.... |
medium | 5.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-87285 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
medium | 6.0 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87267 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
medium | 5.3 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87274 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
medium | 4.4 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87275 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
medium | 4.6 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87278 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
medium | 6.1 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.