September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87279 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
medium | 6.1 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87280 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
medium | 4.2 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87282 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
medium | 6.0 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-87283 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
medium | 6.0 | — | Oracle / vm virtualbox | 2026-09-15 | 2026-09-23 |
| CVE-2026-86516 A vulnerability was detected in elenavanengelenmaslova mocknest-serverless 0.9.0... |
medium | 4.7 | — | — | 2026-09-08 | 2026-09-23 |
| CVE-2026-92455 yshop-crm through 2.1.3 fails to enforce authorization on the sendSms and sendMa... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92457 yshop-crm through 2.1.3 contains a missing authorization vulnerability in the Cr... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92458 yshop-crm through 2.1.3 contains a missing authorization vulnerability in the St... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92460 yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92461 yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GE... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92360 A weakness has been identified in ag-ui-protocol ag-ui 1.0. |
medium | 6.3 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-84835 Missing Authorization vulnerability in DimaFreund Rentsyst rentsyst allows Explo... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-23 |
| CVE-2026-84217 Missing Authorization vulnerability in Mamunur Rashid Classified Listing classif... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-23 |
| CVE-2026-12683 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 5.4 | — | — | 2026-09-10 | 2026-09-23 |
| CVE-2026-12682 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 5.4 | — | — | 2026-09-10 | 2026-09-23 |
| CVE-2026-86805 A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld... |
medium | 6.3 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-17262 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to cause a denial of s... |
medium | 5.4 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-92526 A flaw has been found in itsourcecode Leave Management System 1.0. |
medium | 6.3 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-65393 A permissions issue was addressed with improved validation. |
medium | 5.5 | — | Apple / xcode | 2026-09-14 | 2026-09-22 |
| CVE-2026-20235 A vulnerability in the API of Cisco Identity Services Engine (ISE) could allow a... |
medium | 4.9 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-20282 A vulnerability in Cisco ISE could allow an authenticated, remote attacker to ob... |
medium | 4.9 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92789 Graylog through 7.1.4 validates outbound URLs against an allowlist before making... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92800 Docs before 5.4.1 fails to properly revoke websocket collaboration connections w... |
medium | 6.8 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92802 kan through 0.6.0 fails to properly validate board creation permissions in the G... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92803 LibreTranslate through 1.9.6 omits the access_check decorator from the download_... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92811 browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restric... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92814 changedetection.io through 0.60.6 fails to escape the scraped page title in HTML... |
medium | 4.2 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92920 admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user... |
medium | 5.4 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92921 admin3 through 3.0.0 stores account passwords using single-round MD5 with only t... |
medium | 4.9 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-93454 Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and rend... |
medium | 5.4 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93455 django-page-cms through 2.0.13 fails to properly validate page permissions in ad... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-77927 ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability tha... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-77928 ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability tha... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93736 Mealie before 3.21.0 fails to validate user ownership in the ratings and favorit... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93869 Cotonti through 1.0.0 contains an open redirect vulnerability in the cot_url_che... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93870 Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin A... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93871 Cotonti through 1.0.0 fails to validate redirect destinations in page bodies pre... |
medium | 5.4 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93873 Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the contact plugin s... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-94533 lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in File... |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-93341 MarketKing plugin for WordPress before 2.1.72 contains a missing authorization v... |
medium | 4.3 | — | — | 2026-09-22 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.