September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-90525 A weakness has been identified in itsourcecode Sales and Inventory System 1.0. |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-20 |
| CVE-2026-90969 Improper access control in the vault entry listing feature in Devolutions Server... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-86764 Snipe-IT through 8.6.4 (fixed in 8.7.0) does not enforce the components.view per... |
medium | 6.5 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-20 |
| CVE-2026-86769 Snipe-IT versions before 8.7.0 contain an improper ownership management vulnerab... |
medium | 4.3 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-20 |
| CVE-2026-86774 Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in... |
medium | 6.3 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-20 |
| CVE-2026-88922 The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privileg... |
medium | 6.7 | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-82519 Really Simple Security plugin for WordPress before 9.8.2 contains a missing auth... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-20 |
| CVE-2026-84850 Improper certificate validation in the shared HTTP client used by synchronizatio... |
medium | 4.8 | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-65382 A parsing issue in the handling of directory paths was addressed with improved p... |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-20 |
| CVE-2026-13272 IBM Verify Identity Access is missing origin validation which could allow a remo... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-20 |
| CVE-2026-11918 IBM ContextForge MCP Gateway <= v1.0.4 IBM mcp-context-forge could allow an auth... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-11927 IBM Security Verify Identity Access reverse proxy may allow parameters to be inj... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-76757 Vulnerability in Drupal Gammu SMS Daemon. |
medium | 5.9 | — | — | 2026-09-02 | 2026-09-19 |
| CVE-2026-92554 The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-86736 snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkou... |
medium | 4.3 | — | Snipeitapp / snipe-it | 2026-09-08 | 2026-09-19 |
| CVE-2026-86749 Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not check the return value of sto... |
medium | 6.3 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-19 |
| CVE-2026-90541 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to req... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-19 |
| CVE-2026-92249 The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cros... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-86726 AVideo through 29.0 contains an information disclosure vulnerability in restream... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-19 |
| CVE-2026-86731 Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard i... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-19 |
| CVE-2026-78296 Insufficient Verification of Data Authenticity vulnerability in WP ManageNinja L... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-78294 Contributor Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions. |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-81305 CM2507 IP cameras automatically execute a predetermined script from removable me... |
medium | 6.8 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-76755 Vulnerability in Drupal Gammu SMS Daemon. |
medium | 5.9 | — | — | 2026-09-02 | 2026-09-19 |
| CVE-2026-76756 Vulnerability in Drupal Gammu SMS Daemon. |
medium | 5.9 | — | — | 2026-09-02 | 2026-09-19 |
| CVE-2026-66572 Contributor Cross Site Scripting (XSS) in JetBlog <= 2.4.10 versions. |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-66577 Contributor Cross Site Scripting (XSS) in JetSearch <= 3.6.3 versions. |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-66617 Contributor Cross Site Scripting (XSS) in PublishPress Series <= 3.1.3 versions. |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-73999 Contributor Insecure Direct Object References (IDOR) in Cooked <= 1.16.0 version... |
medium | 5.4 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-75961 The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vuln... |
medium | 4.9 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-20072 A vulnerability in the web-based management interface of Cisco ISE could allow a... |
medium | 4.9 | — | — | 2026-09-16 | 2026-09-19 |
| CVE-2026-2585 The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site... |
medium | 6.4 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-1025 IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-1030 IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-1031 IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-18441 The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-15004 The FileBird – WordPress Media Library Folders & File Manager plugin for WordPre... |
medium | 5.4 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-15797 The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimat... |
medium | 6.4 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-12739 The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPr... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-11537 IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to o... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.