September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,171
Critical
1,210
High
4,305
Medium
4,059
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84901 The Eventin WordPress plugin before 4.1.22 does not properly check authorization... |
medium | 4.9 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-13159 The Real Estate Papi WordPress theme through 1.0.5 does not perform capability o... |
medium | 4.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-75793 The SureCart WordPress plugin before 4.7.0 does not consult the site's user regi... |
medium | 6.5 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-84028 The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape... |
medium | 6.8 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-19859 The JetFormBuilder WordPress plugin before 3.6.5.2 does not sanitize a request p... |
medium | 6.5 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-19862 The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip li... |
medium | 4.8 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-80437 The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent sho... |
medium | 4.8 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-80439 The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 doe... |
medium | 4.8 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-84185 A flaw was found in the jwcrypto library, which is used for implementing Javascr... |
medium | 5.9 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85534 A flaw was found in libsoup. |
medium | 5.9 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85769 A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-76925 A flaw was found in Flatpak. |
medium | 5.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-62654 A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). |
medium | 6.8 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-20510 In camera middleware, there is a possible escalation of privilege due to double... |
medium | 6.7 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-20511 In SurfaceFlinger, there is a possible memory corruption due to use after free. |
medium | 6.7 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-20517 In geniezone, there is a possible escalation of privilege due to use after free. |
medium | 6.7 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-20506 In Audio HAL, there is a possible escalation of privilege due to use after free. |
medium | 6.7 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-20507 In Audio HAL, there is a possible escalation of privilege due to use after free. |
medium | 6.7 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-20508 In Power HAL, there is a possible escalation of privilege due to type confusion. |
medium | 6.7 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-20509 In Power HAL, there is a possible out of bounds write due to a missing bounds ch... |
medium | 6.7 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-20512 In Audio HAL, there is a possible escalation of privilege due to improper input... |
medium | 6.7 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-20513 In Audio HAL, there is a possible information disclosure due to improper input v... |
medium | 4.4 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-20514 In Audio HAL, there is a possible information disclosure due to a missing permis... |
medium | 4.4 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-77698 Zohocorp ManageEngine Endpoint Central versions before 11.5.2605.01 are vulnerab... |
medium | 5.7 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-77697 Zohocorp ManageEngine Endpoint Central versions below 11.4.2540.23 are vulnerabl... |
medium | 6.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-77699 Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 are vulnerabl... |
medium | 5.0 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-85640 Zohocorp ManageEngine Endpoint Central versions below 11.5.2600.15 are vulnerabl... |
medium | 6.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-22575 An improper access control vulnerability in Fortinet FortiManager 7.6.0 through... |
medium | 4.9 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-84391 A use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 th... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86667 A weakness has been identified in aircheng-org iWebShop-5 up to 5.15. |
medium | 4.7 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-78602 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (... |
medium | 5.3 | — | Elastic / maps server | 2026-09-02 | 2026-09-08 |
| CVE-2026-86179 A flaw has been found in code-projects Daily Expense Manager 1.0. |
medium | 5.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86232 A weakness has been identified in itsourcecode Sales and Inventory System 1.0. |
medium | 6.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86163 A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. |
medium | 6.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-85701 A vulnerability has been found in ramon-victor freegpt-webui up to 098db3dfeb415... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85636 A vulnerability was identified in jofpin trape 1.0.0. |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85643 A flaw has been found in code-projects Online Shopping System 1.0. |
medium | 4.7 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-16689 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.... |
medium | 5.5 | — | Ibm / app connect enterprise | 2026-09-04 | 2026-09-08 |
| CVE-2026-84327 Incorrect authorization in Autofill in Google Chrome on on Android prior to 152.... |
medium | 6.5 | — | Google / chrome | 2026-09-02 | 2026-09-08 |
| CVE-2026-84330 UI misrepresentation in FullScreen in Google Chrome on on Android prior to 152.0... |
medium | 5.4 | — | Google / chrome | 2026-09-02 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.