September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-95660 A security flaw has been discovered in Moonshot AI Kimi Code up to 0.31.0. |
medium | 6.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-93960 A vulnerability was identified in Pixelfed up to 0.12.11. |
medium | 4.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-93312 A flaw has been found in Freedesktop Poppler 26.07.0. |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93018 Imager versions before 1.036 for Perl disclose uninitialised heap memory reading... |
medium | 5.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-85709 LightRAG provides simple and fast retrieval-augmented generation. |
medium | 5.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-86062 LightRAG provides simple and fast retrieval-augmented generation. |
medium | 6.1 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-81894 Concrete CMS 9.5.2 and below is vulnerable to stored DOM-based Cross-site Script... |
medium | 5.4 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-22 |
| CVE-2026-81896 Concrete CMS before 9.5.3 does not apply HTML entity encoding to user-defined Fo... |
medium | 5.4 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-22 |
| CVE-2026-81897 In Concrete CMS below CMS 9.5.3, the save_control action in the Express entities... |
medium | 5.4 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-22 |
| CVE-2026-73638 Imager versions from 0.45_02 before 1.035 for Perl read outside the EXIF block v... |
medium | 6.2 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-69674 Missing authentication for critical function in Windows Modern Device Management... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-22 |
| CVE-2026-82163 Dell Command | Intel vPro Out of Band, versions prior to 4.7.2, contain an Incor... |
medium | 5.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-82165 Dell Command | Integration Suite for System Center, versions prior to 6.7.2, con... |
medium | 5.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94570 SGLang contains a DoS vulnerability caused by missing input validation for AUX_D... |
medium | 5.9 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-83077 Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM... |
medium | 6.4 | — | Oracle / siebel crm | 2026-09-15 | 2026-09-22 |
| CVE-2026-74765 Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read vi... |
medium | 6.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-83441 Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (comp... |
medium | 6.8 | — | Oracle / product hub | 2026-09-15 | 2026-09-22 |
| CVE-2026-83491 Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (com... |
medium | 6.8 | — | Oracle / irecruitment | 2026-09-15 | 2026-09-22 |
| CVE-2026-94492 A security vulnerability has been detected in Yonyou U8cloud 5.x. |
medium | 6.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-85653 The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-... |
medium | 6.4 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-93655 The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site... |
medium | 6.1 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-12995 The Custom Field Template plugin for WordPress is vulnerable to Insecure Direct... |
medium | 4.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-16778 The Live Composer – Free WordPress Website Builder plugin for WordPress is vulne... |
medium | 6.4 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-18345 The WP User Manager plugin for WordPress is vulnerable to unauthorized modificat... |
medium | 4.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-1645 The Hostel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via... |
medium | 4.4 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-4123 The RW Elephant Rental Inventory plugin for WordPress is vulnerable to Missing A... |
medium | 4.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-7622 The ThumbPress plugin for WordPress is vulnerable to unauthorized access in vers... |
medium | 4.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-9004 The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerab... |
medium | 4.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-15095 The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & So... |
medium | 4.9 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95273 A vulnerability was determined in dgtlmoon changedetection.io up to 0.60.7. |
medium | 4.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-79913 Cloudreve is a self-hosted file management and sharing system. |
medium | 6.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-56682 9Router is an AI router & token saver. |
medium | 5.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-69741 Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to dis... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-22 |
| CVE-2026-77122 An authorization flaw in the REST API repository details endpoint (GET /service/... |
medium | 4.3 | — | Sonatype / nexus repository manager | 2026-09-02 | 2026-09-22 |
| CVE-2026-77123 Nexus Repository 3 contains a sensitive information disclosure vulnerability in... |
medium | 6.5 | — | Sonatype / nexus repository manager | 2026-09-02 | 2026-09-22 |
| CVE-2026-93957 A vulnerability has been found in olivier-ls PHP-FTS up to 1.1.3. |
medium | 4.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-93967 A vulnerability was found in aiyiyi121 SxDevOps 1.0/1.1. |
medium | 5.5 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-76796 The LoadImageAsPngBase64 endpoint of the Newell Brands DYMO Connect Desktop loca... |
medium | 4.0 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-71224 A stack overflow vulnerability was found in gfs2-utils. |
medium | 4.7 | — | Redhat / enterprise linux | 2026-09-03 | 2026-09-22 |
| CVE-2026-71222 A heap out-of-bounds read vulnerability was found in gfs2-utils. |
medium | 6.3 | — | Redhat / enterprise linux | 2026-09-03 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.