September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,184
Critical
1,210
High
4,307
Medium
4,070
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-89138 The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-89278 The GPTranslate – Multilingual AI Translation Agent for WordPress: Translate You... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-84909 The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress... |
medium | 6.4 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-75880 An authenticated client could attach a consumer with a selector containing craft... |
medium | 6.5 | — | Apache / artemis | 2026-09-10 | 2026-09-18 |
| CVE-2026-75017 The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-20285 A vulnerability in the web-based management interface of Cisco Identity Services... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20350 A vulnerability in the web-based management interface of Cisco ThousandEyes Virt... |
medium | 4.7 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-16582 The Booking for Appointments and Events Calendar – Amelia plugin for WordPress i... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-17576 The InfiniteWP Client plugin for WordPress is vulnerable to SQL Injection via th... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-18317 The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-17586 The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cr... |
medium | 6.4 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-14311 The Booking for Appointments and Events Calendar – Amelia plugin for WordPress i... |
medium | 5.4 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-15650 The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin for WordPr... |
medium | 6.4 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-12106 The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side... |
medium | 6.4 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-81927 Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability... |
medium | 5.4 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-18 |
| CVE-2026-86902 A parsing issue in the handling of directory paths was addressed with improved p... |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-86900 An out-of-bounds read issue was addressed with improved input validation. |
medium | 6.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-86898 A logic issue was addressed with improved state management. |
medium | 5.4 | — | Apple / safari | 2026-09-14 | 2026-09-18 |
| CVE-2026-81918 Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field i... |
medium | 4.8 | — | Concretecms / concrete cms | 2026-09-11 | 2026-09-18 |
| CVE-2026-71403 A flaw was found in Rancher Manager. |
medium | 6.1 | — | Suse / rancher | 2026-09-03 | 2026-09-18 |
| CVE-2026-86886 A path traversal issue was addressed with improved input validation. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84622 A memory initialization issue was addressed with improved memory handling. |
medium | 6.2 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84616 A type confusion issue was addressed with improved memory handling. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-88005 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
medium | 6.5 | — | Openwebui / open webui | 2026-09-10 | 2026-09-18 |
| CVE-2026-88006 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat... |
medium | 6.5 | — | Openwebui / open webui | 2026-09-10 | 2026-09-18 |
| CVE-2026-90804 A vulnerability was detected in GNU Binutils 2.47. |
medium | 6.1 | — | Gnu / binutils | 2026-09-14 | 2026-09-18 |
| CVE-2026-90801 A security flaw has been discovered in GNU Binutils 2.47. |
medium | 6.6 | — | Gnu / binutils | 2026-09-14 | 2026-09-18 |
| CVE-2026-90802 A weakness has been identified in GNU Binutils 2.47. |
medium | 4.4 | — | Gnu / binutils | 2026-09-14 | 2026-09-18 |
| CVE-2026-90803 A security vulnerability has been detected in GNU Binutils 2.47. |
medium | 6.8 | — | Gnu / binutils | 2026-09-14 | 2026-09-18 |
| CVE-2026-84571 A buffer overflow was addressed with improved bounds checking. |
medium | 4.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-43674 An authentication issue was addressed with improved state management. |
medium | 4.6 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-65376 An out-of-bounds read was addressed with improved bounds checking. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-65358 A race condition was addressed with improved state handling. |
medium | 4.7 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-65361 This issue was addressed with improved checks. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-84602 A type confusion issue was addressed with improved checks. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-28836 A correctness issue was addressed with improved checks. |
medium | 6.1 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-84439 When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated... |
medium | 5.3 | — | Apache / zookeeper | 2026-09-16 | 2026-09-18 |
| CVE-2026-84501 An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooK... |
medium | 5.3 | — | Apache / zookeeper | 2026-09-16 | 2026-09-18 |
| CVE-2026-86892 This issue was addressed with additional entitlement checks. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-75035 A flaw was found in Rancher Manager. |
medium | 6.5 | — | Suse / rancher | 2026-09-03 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.