September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87965 The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessabl... |
medium | 4.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-87966 The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an owners... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-88798 The Really Simple Security WordPress plugin before 9.8.3 does not validate a cli... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-88993 The All Bootstrap Blocks WordPress plugin through 1.3.31 does not properly escap... |
medium | 6.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-90984 The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not res... |
medium | 5.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-79713 The Breeze Cache WordPress plugin before 2.5.15 does not include a set of tracki... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-86796 The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a reque... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-86800 The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-88994 The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a blo... |
medium | 6.6 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-90976 The Clean Login WordPress plugin before 1.19 does not check whether user registr... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-90977 The Clean Login WordPress plugin before 1.19 does not verify its registration CA... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-25684 A file type attribution issue in Zscaler Internet Access File Type Control evalu... |
medium | 4.4 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-90982 @fastify/static is a Fastify plugin that serves static files from a configured r... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-13623 An improper neutralization of input during web page generation ('Cross-site Scri... |
medium | 4.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-40533 An exposure of sensitive information through data queries vulnerability in Deskt... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-40534 An improper neutralization of input during web page generation ('cross-site scri... |
medium | 5.4 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-40535 An improper limitation of a pathname to a restricted directory ('path traversal'... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-40536 An improper limitation of a pathname to a restricted directory ('path traversal'... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-40537 A server-side request forgery (SSRF) vulnerability in PersonMail API in Synology... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-92894 A flaw was found in the foreman_ansible plugin's Ansible override values API. |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-92893 A flaw was found in the foreman_ansible plugin's Ansible inventory API. |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-92904 A flaw was found in the foreman_remote_execution plugin's template invocations c... |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-71568 In BMCtest, Ironic is started without authentication and TLS for the duration of... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-93493 A flaw was found in Netty's `netty-handler-ssl-ocsp` component. |
medium | 5.9 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-93578 A flaw was found in Netty's Online Certificate Status Protocol (OCSP) Client. |
medium | 5.9 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-93653 A denial of service flaw was found in Poppler's Splash backend. |
medium | 5.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-77960 Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read ac... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-86689 Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read ac... |
medium | 5.9 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-81911 Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom... |
medium | 5.4 | — | Concretecms / concrete cms | 2026-09-11 | 2026-09-18 |
| CVE-2026-93596 ArcadeDB before 26.9.1 (com.arcadedb:arcadedb-engine <= 26.8.1) fails to bind th... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-92468 zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vu... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92363 A flaw has been found in ag-ui-protocol ag-ui 1.0. |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-19542 Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to... |
medium | 5.6 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-77117 Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character... |
medium | 5.9 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-80489 Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character en... |
medium | 5.9 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-8674 Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMA... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-1029 IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0... |
medium | 5.4 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-1037 IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-89044 Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.... |
medium | 6.5 | — | Netty / netty | 2026-09-10 | 2026-09-18 |
| CVE-2026-88875 AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-0... |
medium | 4.3 | — | — | 2026-09-10 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.