September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,171
Critical
1,210
High
4,305
Medium
4,059
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-78377 URL redirection to untrusted site ('open redirect') vulnerability in Yordam Info... |
medium | 6.1 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-12956 The WP Event Solution (Eventin) plugin for WordPress is vulnerable to Missing Au... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-13709 The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerabl... |
medium | 6.4 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-19944 The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection... |
medium | 4.9 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-77186 The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to... |
medium | 6.4 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-7804 The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to... |
medium | 6.1 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-19945 The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 6.4 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-84908 The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in ver... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-19778 The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center &... |
medium | 6.5 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-86347 Affected versions of MISP allow any authenticated user to access TemplatesContro... |
medium | 6.5 | — | Misp-project / misp | 2026-09-07 | 2026-09-09 |
| CVE-2026-86351 Affected versions of MISP validate the user-configurable homepage by checking on... |
medium | 6.1 | — | Misp-project / misp | 2026-09-07 | 2026-09-09 |
| CVE-2026-86408 Affected versions of MISP do not enforce parent-event visibility when serving cr... |
medium | 6.5 | — | Misp-project / misp | 2026-09-07 | 2026-09-09 |
| CVE-2026-86417 Affected versions of MISP inconsistently enforced email-address visibility in Da... |
medium | 4.3 | — | Misp-project / misp | 2026-09-07 | 2026-09-09 |
| CVE-2026-86440 Affected versions of MISP insufficiently validate URLs used by dashboard widgets... |
medium | 5.4 | — | Misp-project / misp | 2026-09-07 | 2026-09-09 |
| CVE-2026-86441 Affected versions of MISP contain inconsistent authorization checks across dashb... |
medium | 4.3 | — | Misp-project / misp | 2026-09-07 | 2026-09-09 |
| CVE-2026-86451 Affected versions of MISP allow authenticated users to retrieve object-reference... |
medium | 4.3 | — | Misp-project / misp | 2026-09-07 | 2026-09-09 |
| CVE-2026-86342 Affected versions of MISP contain improper authorization checks in the freetext... |
medium | 4.3 | — | Misp-project / misp | 2026-09-07 | 2026-09-09 |
| CVE-2026-86436 Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image... |
medium | 5.4 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86308 A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99... |
medium | 5.3 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86319 A vulnerability has been found in java-json-tools json-patch up to 1.13. |
medium | 5.3 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86279 A vulnerability was determined in SourceCodester Syllabus-Aligned Learning Manag... |
medium | 6.3 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86285 A vulnerability was detected in BookStack up to 26.05.2. |
medium | 4.3 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86302 A vulnerability was found in code-projects Hospital Information System 1.0. |
medium | 5.3 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86271 A vulnerability was found in FluentCMS up to 0.0.5. |
medium | 4.7 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-86215 A vulnerability was identified in Mstfakts College-Management-System. |
medium | 4.3 | — | — | 2026-09-06 | 2026-09-09 |
| CVE-2026-86234 A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. |
medium | 6.3 | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-17622 IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacke... |
medium | 6.5 | — | Langflow / langflow | 2026-09-04 | 2026-09-09 |
| CVE-2026-17631 IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacke... |
medium | 6.5 | — | Langflow / langflow | 2026-09-04 | 2026-09-09 |
| CVE-2026-19649 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.... |
medium | 5.5 | — | Ibm / app connect enterprise | 2026-09-04 | 2026-09-09 |
| CVE-2026-16180 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.... |
medium | 5.7 | — | Ibm / app connect enterprise | 2026-09-04 | 2026-09-09 |
| CVE-2026-17274 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypa... |
medium | 5.4 | — | Ibm / i | 2026-09-04 | 2026-09-09 |
| CVE-2026-86256 wger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerabi... |
medium | 5.4 | — | — | 2026-09-06 | 2026-09-09 |
| CVE-2026-86251 h3 versions before 1.15.9 contain a path traversal vulnerability in the serveSta... |
medium | 5.9 | — | — | 2026-09-06 | 2026-09-09 |
| CVE-2026-86170 A weakness has been identified in DefaultFuction CRM 1.0.0. |
medium | 6.3 | — | — | 2026-09-06 | 2026-09-09 |
| CVE-2026-17440 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.... |
medium | 5.5 | — | Ibm / app connect enterprise | 2026-09-04 | 2026-09-09 |
| CVE-2026-79904 Photoshop Mobile is affected by an Improper Limitation of a Pathname to a Restri... |
medium | 5.0 | — | Adobe / photoshop mobile | 2026-09-08 | 2026-09-09 |
| CVE-2026-86735 snipe-it versions before 8.7.0 contain a server-side request forgery vulnerabili... |
medium | 5.0 | — | Snipeitapp / snipe-it | 2026-09-08 | 2026-09-09 |
| CVE-2026-77847 Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a us... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-83534 PostgreSQL Anonymizer contains a vulnerability in the anon.anonymize_database_pa... |
medium | 6.4 | — | — | 2026-09-06 | 2026-09-09 |
| CVE-2026-19634 PostgreSQL Anonymizer contains a SQL injection vulnerability in two import funct... |
medium | 6.4 | — | — | 2026-09-06 | 2026-09-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.