September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,184
Critical
1,210
High
4,307
Medium
4,070
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-76000 ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability tha... |
medium | 6.5 | — | Adobe / coldfusion | 2026-09-08 | 2026-09-18 |
| CVE-2026-76002 ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. |
medium | 6.1 | — | Adobe / coldfusion | 2026-09-08 | 2026-09-18 |
| CVE-2026-16750 The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-86884 A permissions issue was addressed with additional restrictions. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84615 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-84600 An authorization issue was addressed with improved state management. |
medium | 5.4 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-92131 Jenkins Pipeline: Groovy Libraries Plugin 805.va_fc79344957d and earlier does no... |
medium | 4.2 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92132 Jenkins Gradle Plugin 2.19.1252.v15196b_5a_6e10 and earlier requests build scan... |
medium | 5.4 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92133 Jenkins GitLab Plugin 1.2149.vcfc32c82b_f7f and earlier caches the GitLab API cl... |
medium | 5.4 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92138 The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin... |
medium | 4.2 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92139 Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values p... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92140 Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender n... |
medium | 6.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92141 Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the r... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-21822 HCLSoftware AppScan 360° was affected by a Path Traversal vulnerability in the A... |
medium | 6.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-86909 A logic issue was addressed with improved state management. |
medium | 4.4 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-20120 A vulnerability in the access control list (ACL) Object Group Search (OGS) imple... |
medium | 5.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20121 A vulnerability in the access control list (ACL) Object Group Search (OGS) imple... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20248 A vulnerability in the DNS over TCP implementation of Cisco Secure Firewall Adap... |
medium | 6.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20283 A vulnerability in the IPsec Open API endpoint of Cisco ISE could allow an authe... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20286 A vulnerability in the web-based management interface of Cisco Identify Services... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20287 As part of Cisco's ongoing commitment to proactive security and product quality,... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20290 A vulnerability in SSL/TLS certificate parsing in the Snort 2 Detection Engine o... |
medium | 5.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20309 A vulnerability in the web-based management interface of Cisco Identity Services... |
medium | 6.1 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-76438 A vulnerability in the web-based management interface of Cisco BroadWorks CommPi... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-93308 A vulnerability was found in O-RAN-SC SMO OAM 2025-06-10. |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-93313 A vulnerability was found in Freedesktop Poppler 26.07.0. |
medium | 6.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-92991 The Biggop Library is vulnerable to Cross-Site Scripting via the ‘display_id’ pa... |
medium | 5.4 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-75016 The Magazine Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 6.4 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-89330 The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos,... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-92714 The Download Manager plugin for WordPress is vulnerable to Insecure Direct Objec... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-14472 The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Sit... |
medium | 6.4 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-17607 The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-90981 The Newsletter – Send awesome emails from WordPress plugin for WordPress is vuln... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-90884 The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 5.4 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-84635 A logic issue was addressed with improved state management. |
medium | 6.5 | — | Apple / safari | 2026-09-14 | 2026-09-18 |
| CVE-2026-58698 In ap_pmic_poll_msg_handler of ap_pmic_ipc.c, there is a possible permission byp... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58716 In multiple locations, there is a possible time-of-check to time-of-use due to a... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58773 In link_load_gnss_image of link_device.c, there is a possible out-of-bounds writ... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-86924 A memory corruption issue was addressed with improved input validation. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-58767 In multiple functions of arm-smmu-v3.c, there is a possible escalation of privil... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.