September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-89207 A vulnerability has been identified in WTV676-HB6035 Web Interface (All versions... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-28966 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 4.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-19596 An XML External Entity (XXE) vulnerability exists in the XML collector of multip... |
medium | 5.9 | — | — | 2026-09-10 | 2026-09-18 |
| CVE-2026-89089 A SQL injection vulnerability exists in the JasperReports-based reporting featur... |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-18 |
| CVE-2026-59341 A security vulnerability exists in the Sealed Secrets controller's unauthenticat... |
medium | 4.2 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-28968 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-87076 Tanium addressed an information disclosure vulnerability in Discover. |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-87113 Tanium addressed an improper access controls vulnerability in Threat Response. |
medium | 6.3 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-87116 Tanium addressed a server-side request forgery vulnerability in Threat Response. |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-65360 A race condition was addressed with improved state handling. |
medium | 4.7 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84859 ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Blind S... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92413 A flaw has been found in Artifex MuPDF up to b6d17493700c621c0e70036980a6ebd06d2... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-83278 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: hel... |
medium | 6.8 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-90890 ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. |
medium | 5.5 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-90891 ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. |
medium | 5.5 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-93531 A weakness has been identified in gedelumbung HospitalManagement up to c2d455437... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-93534 A vulnerability was identified in spatie Scotty up to 1.4.2. |
medium | 6.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-3096 The product's web portals allow external links to be opened in a new browser tab... |
medium | 4.7 | — | — | 2026-09-10 | 2026-09-18 |
| CVE-2026-4103 Insufficient HTML sanitization in the Publisher Portal and Developer Portal allo... |
medium | 6.4 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2025-5802 The self-registration flow accepts user-supplied input for usernames without ade... |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-81903 Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submit... |
medium | 5.4 | — | Concretecms / concrete cms | 2026-09-14 | 2026-09-18 |
| CVE-2026-14986 The ITE it51xxx I2C driver, when operating as an I2C target (slave) in buffer mo... |
medium | 6.8 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-16514 gptp_mi_qualify_announce() in subsys/net/l2/ethernet/gptp/gptp_mi.c walks the Pa... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-19504 Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability. |
medium | 4.0 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-86788 The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict... |
medium | 6.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-86824 The Newsletter WordPress plugin before 9.3.8 does not generate its email trackin... |
medium | 4.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-90922 The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-90923 The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one... |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-91009 The Active Woot Products Tables for WooCommerce. |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-91010 The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPres... |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-91011 The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape... |
medium | 6.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-91015 The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform a... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-91016 The Motors WordPress plugin before 1.4.121 does not verify that a request is aut... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-91019 The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not... |
medium | 4.9 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-87829 The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin b... |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-87831 The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin b... |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-84902 The King Addons for Elementor WordPress plugin before 51.1.81 does not perform a... |
medium | 6.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-85009 The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-85123 The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not vali... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-85350 The UpsellWP WordPress plugin before 2.2.10 does not check that products added t... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.