September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87595 Server-side request forgery in Mobile in Google Chrome prior to 153.0.8010.36 al... |
critical | 9.8 | — | Google / chrome | 2026-09-09 | 2026-09-14 |
| CVE-2026-75800 The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signatu... |
critical | 9.8 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-77005 The CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 does not validate a us... |
critical | 9.6 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-81402 The DS Ad Rotator WordPress plugin through 0.8 does not perform any capability c... |
critical | 9.8 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-82845 The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied v... |
critical | 9.9 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-84171 The WP images upload on piclect WordPress plugin through 1.0 does not validate t... |
critical | 9.8 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-85681 The WP Component WordPress plugin through 2.2.4 does not have any capability or... |
critical | 9.8 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-82232 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-86460 Cypher injection vulnerability in the Neo4j persistence layer when processing so... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-87785 Authentication bypass by spoofing vulnerability in Apache Syncope. |
critical | 9.1 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-87802 Improper verification of cryptographic signature vulnerability in Apache Syncope... |
critical | 9.1 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-73470 Improper Privilege Management vulnerability in Apache Syncope. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-73579 Incorrect Authorization vulnerability in Apache Syncope. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-73668 Incorrect Authorization vulnerability in Apache Syncope. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-75030 Missing Authorization vulnerability in Apache Syncope. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-77051 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-77181 Incorrect Authorization vulnerability in Apache Syncope. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-78330 Incorrect privilege assignment vulnerability in Apache Syncope. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-73370 Incorrect Authorization vulnerability in Apache Syncope. |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-82439 Description
The DRPC server kept a map from function name to request queue and... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-82441 Description
A submitted topology carries two lists of blobstore keys, `dependen... |
critical | 9.1 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-82431 Description
`SimpleACLAuthorizer` evaluated the user-level command set by retur... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-82435 Description
The worker's Netty message decoder is installed ahead of the SASL a... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90607 A vulnerability was detected in Totolink A3002MU Hh-B20211125.1046. |
critical | 9.9 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90699 A weakness has been identified in D-Link DWR-M920 1.1.7. |
critical | 9.9 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-86751 Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note f... |
critical | 9.6 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-14 |
| CVE-2026-86543 knowns versions before 0.30.0 serve the management API without authentication on... |
critical | 9.8 | — | — | 2026-09-07 | 2026-09-14 |
| CVE-2026-78006 The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execut... |
critical | 9.8 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-88018 rclone is a command-line program to sync files and directories to and from diffe... |
critical | 9.8 | — | Rclone / rclone | 2026-09-10 | 2026-09-14 |
| CVE-2026-88008 Traefik is an open source HTTP reverse proxy and load balancer. |
critical | 9.1 | — | Traefik / traefik | 2026-09-10 | 2026-09-14 |
| CVE-2026-88007 Traefik is an open source HTTP reverse proxy and load balancer. |
critical | 9.1 | — | Traefik / traefik | 2026-09-10 | 2026-09-14 |
| CVE-2026-80352 Improper Control of Generation of Code ('Code Injection') vulnerability in Apach... |
critical | 9.8 | — | Apache / camel | 2026-09-10 | 2026-09-14 |
| CVE-2026-80351 Improper neutralization of directives in dynamically evaluated code ('eval injec... |
critical | 9.8 | — | Apache / camel | 2026-09-10 | 2026-09-14 |
| CVE-2026-86793 SGLang allows unauthenticated pickle deserialization through /update_weights_fro... |
critical | 9.8 | — | — | 2026-09-11 | 2026-09-14 |
| CVE-2026-68006 An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitr... |
critical | 9.1 | — | — | 2026-09-10 | 2026-09-14 |
| CVE-2026-38626 Garlic-Hub v1.0.1 is vulnerable to SQL Injection in src/Modules/Items/Repositori... |
critical | 9.8 | — | — | 2026-09-10 | 2026-09-14 |
| CVE-2026-78159 The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execut... |
critical | 9.8 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-87929 MaxSite CMS through 109.6 ships with a hardcoded session encryption key in appli... |
critical | 9.8 | — | — | 2026-09-09 | 2026-09-14 |
| CVE-2026-85507 ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-14 |
| CVE-2026-79577 An issue in the /cas/login component of sso-master v1.0.0 allows attackers to au... |
critical | 9.8 | — | — | 2026-09-08 | 2026-09-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.