September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,182
Critical
1,210
High
4,307
Medium
4,068
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-82073 A security issue in the MongoDB Server aggregation framework allows an authentic... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-69211 Http4s is a Scala interface for HTTP services. |
medium | 4.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-69214 Http4s is a Scala interface for HTTP services. |
medium | 6.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-69216 Http4s is a Scala interface for HTTP services. |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-69206 Http4s is a Scala interface for HTTP services. |
medium | 5.9 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-69215 Http4s is a Scala interface for HTTP services. |
medium | 6.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-82070 A security issue in MongoDB Server's diagnostic reporting interface allows an au... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82069 A security issue in MongoDB Server's query statistics serialization on the route... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-89321 Publishing limits the compressed size of a VSIX (ovsx.publishing.max-content-siz... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-92237 Insertion of sensitive information into log file in the slow query logging featu... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-82068 A security issue in MongoDB Server allows an authenticated user with write privi... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-69201 Http4s is a Scala interface for HTTP services. |
medium | 5.9 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-69212 Http4s is a Scala interface for HTTP services. |
medium | 5.9 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-82065 A security issue in the MongoDB Server's storage engine integration layer allows... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82063 A use-after-free security issue in the cursor management component of MongoDB Se... |
medium | 5.3 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82062 A security issue in MongoDB Server allows an authenticated user with elevated in... |
medium | 5.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82060 In MongoDB, insufficient validation of shard key values during document insertio... |
medium | 5.4 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82059 An internal aggregation expression in MongoDB Server was incorrectly registered... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82058 A flaw in MongoDB's JSON Schema validation error generation code allows an authe... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82055 A security issue exists in MongoDB's 2dsphere index key generation that can caus... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82056 A race condition in MongoDB server's text index query parsing can cause a heap u... |
medium | 5.3 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82057 A security issue was discovered in MongoDB where an authenticated user with read... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-86772 Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerabili... |
medium | 5.4 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-86768 Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpo... |
medium | 5.4 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-86767 Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET... |
medium | 5.0 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-86766 Snipe-IT versions up to and including 8.6.3 contain a race condition (TOCTOU) in... |
medium | 6.5 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-86765 Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assig... |
medium | 6.5 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-86761 snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in... |
medium | 4.3 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-86760 Snipe-IT versions 8.2.0 through 8.6.x (fixed in 8.7.0) contain an incorrect auth... |
medium | 5.4 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-86758 Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate... |
medium | 6.5 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-86757 Snipe-IT before 8.7.0 fails to properly gate access to encrypted custom-field va... |
medium | 6.5 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-16593 The WP Directory Kit WordPress plugin through 1.5.7 does not sanitize and escape... |
medium | 6.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-18232 The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or... |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-13407 The Royal Elementor Addons WordPress plugin before 1.7.1067 does not properly sa... |
medium | 5.4 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-19857 The Formidable Forms WordPress plugin before 6.35 does not prevent a request-der... |
medium | 4.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-84906 The Eventin WordPress plugin before 4.1.24 does not verify that a completed paym... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-86475 The Appointment Hour Booking WordPress plugin before 1.5.95 does not check every... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-86756 Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML... |
medium | 6.1 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-86755 Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered... |
medium | 5.4 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-86773 Snipe-IT through version 8.6.3 fails to perform object-level authorization in th... |
medium | 5.4 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.