September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-93344 MarketKing plugin for WordPress before 2.1.72 contains a missing authorization v... |
medium | 6.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-73759 Vulnerabilities in AOS-CX could allow an unauthenticated remote malicious actor... |
medium | 6.5 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-22 |
| CVE-2026-92810 PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in t... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-89034 TCH QRing smart ring model R20_B006 running firmware RT09R20_1.00.00_250318 cont... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92579 In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded allow... |
medium | 5.4 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92581 In AVideo through 29.0, Like::__construct() performs counter arithmetic on raw r... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92583 AVideo through 29.0 contains a race condition in the enforceRateLimit() function... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92584 AVideo through 29.0 (current revision e01e41ecc) contains a stored cross-site sc... |
medium | 6.1 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92585 AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to v... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92586 AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to v... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92912 AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 uses cryptographically w... |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-93660 SQLBot through 1.10.1 fails to verify dashboard ownership in update_resource and... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-81943 PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions bef... |
medium | 6.7 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-81946 PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions bef... |
medium | 4.4 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93838 SGLang versions through 0.5.20 contain an unbounded memory allocation vulnerabil... |
medium | 5.9 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-94105 NivoCart through 2.4.0 contains a destructive configuration write vulnerability... |
medium | 5.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-94111 Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerabili... |
medium | 6.6 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-94413 jshERP through 3.6 fails to redact password hashes in the /user/info endpoint, a... |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94414 jshERP through 3.6 is missing an authorization check on the POST /userBusiness/u... |
medium | 5.4 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94494 jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows... |
medium | 5.0 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-78620 The Okta Access Gateway Kerberos configuration handler does not validate file pa... |
medium | 4.9 | — | Okta / access gateway | 2026-09-08 | 2026-09-22 |
| CVE-2026-93737 Azkaban through 4.0.0 omits project permission checks in the ScheduleServlet fet... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93338 Grandstream GWN7660ELR before firmware version 1.0.27.6 contains an information... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-92813 Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.... |
medium | 4.9 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92589 Craft CMS 5.0.0 through 5.10.12 (fixed in 5.10.13) contains a broken access cont... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92590 Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripti... |
medium | 5.4 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92591 Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning... |
medium | 5.9 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92595 Nodemailer (npm package `nodemailer`) versions 9.1.0 and earlier do not honor th... |
medium | 5.9 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92597 Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email a... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92598 Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding intern... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-89038 Verizon Cloud for Android (com.vcast.mediamanager) before 26.7.10 contains a pat... |
medium | 6.2 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-93602 rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL au... |
medium | 4.4 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93689 WinFsp through 2.2.26215 contains a null pointer dereference vulnerability in th... |
medium | 5.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93751 uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDec... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-94108 getID3 through 1.9.26 contains an XML external entity injection vulnerability in... |
medium | 6.5 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-78624 The Okta Access Gateway backup restore function does not validate the filename e... |
medium | 4.9 | — | Okta / access gateway | 2026-09-08 | 2026-09-22 |
| CVE-2026-95624 The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolea... |
medium | 6.8 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-93711 Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response head... |
medium | 6.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-76192 InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that co... |
medium | 5.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-78625 The Okta Access Gateway does not sanitize dashboard label values before writing... |
medium | 6.7 | — | Okta / access gateway | 2026-09-08 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.