September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,171
Critical
1,210
High
4,305
Medium
4,059
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-74236 GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85577 AVideo through commit c91b5975d contains a reflected cross-site scripting vulner... |
medium | 5.4 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85579 SiYuan is affected by an information disclosure vulnerability (confirmed in v3.8... |
medium | 4.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85580 SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the M... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85582 SiYuan versions before v3.8.2 contain an unbounded session creation vulnerabilit... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85600 Grav Admin (getgrav/grav-plugin-admin2) versions <= 2.0.19 contain a stored cros... |
medium | 5.4 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85602 The Grav Form plugin (getgrav/grav-plugin-form) versions 8.0.6 through 9.1.19 se... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-86100 Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when... |
medium | 6.4 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86111 BookWyrm through 0.9.1 fails to validate user visibility permissions in the stat... |
medium | 6.5 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86113 BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edi... |
medium | 6.5 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86186 AVideo API fails to enforce rate limits when clients send a bot User-Agent heade... |
medium | 6.5 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86191 SiYuan versions before v3.8.2 contain an information disclosure vulnerability in... |
medium | 4.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2022-51008 PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing at... |
medium | 5.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86175 NetBox through 4.7.0 fails to redact sensitive data source backend credentials i... |
medium | 6.5 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86205 h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the red... |
medium | 5.4 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86252 h3 versions before 1.15.9 fail to sanitize carriage return characters in EventSt... |
medium | 5.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86254 wger versions through master contain an incomplete authorization bypass in wger/... |
medium | 6.8 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86257 wger before 2.6 fails to sanitize first_name and last_name fields in the gym mem... |
medium | 5.4 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-18073 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to injec... |
medium | 4.4 | — | Ibm / i | 2026-09-04 | 2026-09-08 |
| CVE-2026-18078 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to caus... |
medium | 6.5 | — | Ibm / i | 2026-09-04 | 2026-09-08 |
| CVE-2026-75163 An information disclosure vulnerability in the ugw-deviceinfo method of /cgi-bin... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-75164 An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solution... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-75168 An issue in the ugw-editfile method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Se... |
medium | 6.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-78970 JeecgBoot 3.9.2 and earlier contains an authorization bypass vulnerability in th... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-19032 jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supp... |
medium | 5.3 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83557 DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automat... |
medium | 5.6 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-18238 The rpcap client code that processes a RPCAP_MSG_PACKET message received from th... |
medium | 5.0 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-18313 rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPC... |
medium | 4.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-31911 libpcap BPF interpreter calls abort() if it encounters a BPF instruction that ha... |
medium | 5.5 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-31912 libpcap BPF interpreter detects neither reaching the end of the filter program b... |
medium | 5.5 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-6244 libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not... |
medium | 5.5 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-79603 x86 PV guests can free memory pages while still keeping a stale TLB entry
pointi... |
medium | 4.3 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86237 A vulnerability was found in openagents-org openagents up to 0.8.19/0.9.3.post20... |
medium | 5.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86164 A security flaw has been discovered in itsourcecode Sales and Inventory System 1... |
medium | 6.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-85229 ** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of input during web page... |
medium | 6.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-82309 Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outb... |
medium | 4.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-17517 The Content Views WordPress plugin before 4.5.1.2 does not check whether the use... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-74853 The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a dis... |
medium | 6.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-79630 The WPFunnels WordPress plugin before 3.13.0 does not verify that the product re... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-79631 The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.