September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,171
Critical
1,210
High
4,305
Medium
4,059
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-16693 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obta... |
medium | 4.9 | — | Ibm / i | 2026-09-04 | 2026-09-08 |
| CVE-2026-16892 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypa... |
medium | 5.4 | — | Ibm / i | 2026-09-04 | 2026-09-08 |
| CVE-2026-86274 A security vulnerability has been detected in projeto-siga siga up to 11.0.2.10/... |
medium | 5.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-85513 A weakness has been identified in StackStorm st2 up to 3.9.0. |
medium | 6.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-18021 The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for W... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-12853 The Flamingo plugin for WordPress is vulnerable to authorization bypass in all v... |
medium | 5.4 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-17259 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to caus... |
medium | 6.5 | — | Ibm / i | 2026-09-04 | 2026-09-08 |
| CVE-2026-85044 Use of released resource in Mobile in Google Chrome on on Android prior to 152.0... |
medium | 6.5 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-86233 A security vulnerability has been detected in itsourcecode Sales and Inventory S... |
medium | 6.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-85787 An incomplete list of disallowed inputs in the SQL validation component in Amazo... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-86506 In JetBrains GoLand before 2026.2.2.1 missing authentication on the GoLand profi... |
medium | 5.9 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86481 In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of... |
medium | 4.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86483 In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile... |
medium | 5.4 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86484 In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assign... |
medium | 4.6 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86488 In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListC... |
medium | 6.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86489 In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclo... |
medium | 6.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86490 In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed ove... |
medium | 6.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86493 In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed rea... |
medium | 6.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86495 In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed crea... |
medium | 6.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86496 In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk aut... |
medium | 4.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86497 In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-aut... |
medium | 6.8 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86499 In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all gr... |
medium | 4.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86500 In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user... |
medium | 5.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-0001 Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valha... |
medium | 4.4 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-8279 The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deleti... |
medium | 5.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86317 A vulnerability was detected in ggml-org llama.cpp up to 0.4.0. |
medium | 5.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86270 A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. |
medium | 6.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86275 A vulnerability was detected in SourceCodester Syllabus-Aligned Learning Managem... |
medium | 5.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86278 A vulnerability was found in SourceCodester Syllabus-Aligned Learning Management... |
medium | 4.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86284 A security vulnerability has been detected in jaychouchannel Tourism-Management-... |
medium | 5.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86291 A security vulnerability has been detected in itsourcecode Sales and Inventory S... |
medium | 6.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86238 A vulnerability was determined in projectworlds Online Examination System 1.0. |
medium | 4.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-85381 A security vulnerability has been detected in light0011 cms c774dce31c6df0055568... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-76931 The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Si... |
medium | 6.4 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-71216 PagerDuty alarm hook transmits the integration routing key over cleartext HTTP. |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-18986 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 4.8 | — | Entity Browser Project / entity browser | 2026-09-02 | 2026-09-08 |
| CVE-2026-16647 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal... |
medium | 4.1 | — | Zyxware / disable login page | 2026-09-02 | 2026-09-08 |
| CVE-2026-78593 An insufficiently validated configuration field in Kibana's Cribl integration al... |
medium | 4.3 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-78595 Missing Authorization in Kibana Leading to Information Disclosure / Missing Auth... |
medium | 4.3 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-78596 Missing Authorization in Kibana Leading to Unauthorized Modification of Data / M... |
medium | 4.3 | — | — | 2026-09-03 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.