September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,182
Critical
1,210
High
4,307
Medium
4,068
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-88871 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master, 202... |
medium | 4.3 | — | — | 2026-09-10 | 2026-09-15 |
| CVE-2026-88046 rclone is a command-line program to sync files and directories to and from diffe... |
medium | 5.3 | — | — | 2026-09-10 | 2026-09-15 |
| CVE-2026-18063 The Job Postings plugin for WordPress is vulnerable to Stored Cross-Site Scripti... |
medium | 6.4 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-77488 Integer underflow (wrap or wraparound) in SQL Server allows an authorized attack... |
medium | 5.5 | — | Microsoft / sql server 2017 | 2026-09-08 | 2026-09-15 |
| CVE-2026-57115 PraisonAI is a multi-agent teams system. |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90820 A security vulnerability has been detected in a2aproject a2a-java 1.2.0. |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-85575 The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solu... |
medium | 6.4 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90851 A flaw has been found in PHPGurukul Hostel Management System 3.0. |
medium | 6.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90857 A vulnerability was detected in SourceCodester College Notes Gallery Management... |
medium | 6.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90878 A vulnerability was determined in vllm-project vLLM up to 0.27.1. |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-91002 A weakness has been identified in stamparm maltrail up to 3.0.1. |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-89141 The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPre... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-28584 In createSessionInternal of PackageInstallerService.java, there is a possible wa... |
medium | 5.5 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-84947 undici's dump interceptor reads and discards a response body up to a configurabl... |
medium | 5.3 | — | Nodejs / undici | 2026-09-04 | 2026-09-15 |
| CVE-2026-28596 In parseInterventionFromXml of GameManagerService.java, there is a possible perm... |
medium | 5.5 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28617 In add of WifiNetworkSuggestionsManager.java, there is a possible persistent DOS... |
medium | 5.5 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-85008 undici's cache interceptor documents that only safe HTTP methods are cached, but... |
medium | 5.3 | — | Nodejs / undici | 2026-09-04 | 2026-09-15 |
| CVE-2026-90814 A flaw has been found in cosmicstack-labs mercury-agent up to 1.1.13. |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90795 A vulnerability was determined in itsourcecode Loan Management System 1.0. |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90790 A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90785 A vulnerability was found in Dvidelabs flatcc up to 0.6.3. |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90697 A vulnerability was identified in SourceCodester Inventory Management System 1.0... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90687 A vulnerability was determined in GPAC up to f1219cde. |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90682 A security vulnerability has been detected in Matthias-Wandel jhead up to 3.3. |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90621 A vulnerability was identified in ipa-lab HackingBuddyGPT up to 0.5.0. |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90615 A security vulnerability has been detected in SourceCodester Class and Exam Time... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90600 A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90595 A security flaw has been discovered in wxiaoqi Spring-Cloud-Platform 1.0/2.2/3.0... |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-28627 In btm_sec_encrypt_change of btm_sec.cc, there is a possible downgrade attack du... |
medium | 4.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28633 In initForUserNoTracing of VoiceInteractionManagerService.java, there is a possi... |
medium | 5.5 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-73476 Improper Handling of Case Sensitivity vulnerability in Drupal External Authentic... |
medium | 5.4 | — | External Authentication Project / external authentication | 2026-09-02 | 2026-09-15 |
| CVE-2026-87627 Interpretation conflict in Safebrowsing in Google Chrome on on Mac prior to 153.... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-14 |
| CVE-2026-15892 The mcumgr SMP settings-management group handlers settings_mgmt_read(), settings... |
medium | 5.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-15924 Zephyr's TLS socket layer in subsys/net/lib/sockets/sockets_tls.c keeps a single... |
medium | 5.9 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-16147 The ITE IT82xx2 USB device-controller driver (drivers/usb/udc/udc_it82xx2.c) mis... |
medium | 6.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-77689 The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 d... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-77753 The Temporary Login Without Password WordPress plugin before 1.9.9 does not prev... |
medium | 5.5 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-78152 The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' register... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-82847 The Masteriyo LMS WordPress plugin before 3.4.1 does not sanitise and escape one... |
medium | 6.8 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-83532 The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize a... |
medium | 6.8 | — | — | 2026-09-12 | 2026-09-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.