September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92933 vm2 is a sandbox for running untrusted Node.js code. |
medium | 5.8 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-74002 Unauthenticated Broken Access Control in Booking Calendar <= 11.7 versions. |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-78528 Unauthenticated Broken Access Control in BerqWP <= 4.1.15 versions. |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-27553 A low-privileged remote attacker can manipulate the schema path parameter in the... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-19 |
| CVE-2026-66574 Contributor Cross Site Scripting (XSS) in Element Pack Elementor Addons <= 8.8.3... |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-66579 Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.2.1 v... |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-92963 vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-93310 A vulnerability was identified in O-RAN-SC SMO OAM 2025-06-10. |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-85652 The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-92622 The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site... |
medium | 6.4 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-82980 Any authenticated user can lock or unlock files they do not own by targeting abs... |
medium | 6.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-82982 The Approval app's approve/reject endpoint is meant to require the file's curren... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-82985 The Photos app's filter-based "smart albums" build their file listing using the... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-77164 Circles' remote-instance signature verification fetches the attacker-supplied ke... |
medium | 6.2 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-77169 A vulnerability in the team folders (formerly group folders) app when used in co... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-77170 The Deck config API allows authenticated users to set board-scoped configuration... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-67071 HCL DevOps Deploy / HCL Launch is susceptible to an information disclosure vulne... |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-4036 An improper neutralization of special elements used in an SQL command ('SQL inje... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-40531 An integer overflow or wraparound vulnerability in File Operation in Synology Di... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-40532 A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-16777 The Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Custome... |
medium | 4.9 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-13635 An improper encoding or escaping of output vulnerability in Auth API in Synology... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-13471 The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for W... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-11757 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-56988 In multiple functions of bluetooth_cco.cc, there is a possible use-after-free du... |
medium | 6.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56972 In multiple locations, there is a possible out-of-bounds write due to an incorre... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56973 In multiple locations, there is a possible escalation of privilege due to a logi... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56975 In Cellular Modem, there is a possible denial of service due to improper input v... |
medium | 6.5 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56979 In multiple locations, there is a possible permission bypass due to a logic erro... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-85083 The ANJIA AJL33PC0801 IP camera uses a hard-coded credential for bootloader auth... |
medium | 6.8 | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-68953 The affected products are vulnerable to an authentication bypass that allows una... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-84524 An out-of-bounds read was addressed with improved bounds checking. |
medium | 4.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-66372 The affected products use insufficiently random values, which allows web session... |
medium | 6.8 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-84526 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 4.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84532 An out-of-bounds read issue was addressed with improved input validation. |
medium | 5.4 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-82567 The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint... |
medium | 6.3 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-90439 NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-1759 Improper handling of insufficient permissions or privileges vulnerability in Sec... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-91826 Stack-based buffer overflow vulnerability in Samsung Opensource rLottie allows a... |
medium | 4.4 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-92259 Integer overflow or wraparound vulnerability in Samsung Opensource Escargot allo... |
medium | 5.5 | — | — | 2026-09-15 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.