September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,171
Critical
1,210
High
4,305
Medium
4,059
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-82298 Incorrect Authorization (CWE-863) in Kibana can lead to denial of service via Ex... |
medium | 4.3 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-82299 Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure v... |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-86293 A flaw has been found in SourceCodester Simple Traffic Offense System 1.0. |
medium | 6.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86307 A security vulnerability has been detected in light0011 cms c774dce31c6df0055568... |
medium | 4.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86318 A flaw has been found in java-json-tools json-patch up to 1.13. |
medium | 5.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86280 A vulnerability was identified in SourceCodester Syllabus-Aligned Learning Manag... |
medium | 5.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86288 A vulnerability has been found in ModelCloud GPTQModel up to 7.2.0. |
medium | 6.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86216 A security vulnerability has been detected in code-projects Hotel and Tourism Re... |
medium | 4.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86228 A security vulnerability has been detected in JeecgBoot up to 3.9.3. |
medium | 4.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86235 A flaw has been found in itsourcecode Sales and Inventory System 1.0. |
medium | 6.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86171 A security vulnerability has been detected in DefaultFuction CRM 1.0.0. |
medium | 6.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86182 A vulnerability was determined in diem-project diem up to 5.1.3. |
medium | 4.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86150 A security vulnerability has been detected in Tenda CP3 27.5.57.101. |
medium | 4.1 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-4945 The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plu... |
medium | 5.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-19795 Qiskit could allow a local attacker to cause a denial of service due to a stack... |
medium | 6.2 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-81859 CP4BA - IBM Enterprise Records could allow a local attacker to obtain sensitive... |
medium | 6.2 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-5522 IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 005 contains hard-coded credenti... |
medium | 6.7 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-14350 IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 could allow an un... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-6217 Use of a One-Way hash without a salt vulnerability in Pik Online Software Soluti... |
medium | 6.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-18957 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 5.4 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-19043 Missing Authorization vulnerability in Menulux Software Inc. |
medium | 4.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-19057 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 5.4 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-19081 Missing Authorization vulnerability in Gastromenum Gastromenum Ticket and QR Men... |
medium | 4.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-77818 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-19727 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-14466 It’s possible to run a stored XSS in Stormshield’s web administration panel. |
medium | 4.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-80180 Stored XSS via markdown HTML processing in Apache Allura. |
medium | 6.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-80190 Apache Allura: stored XSS via SVN code repositories. |
medium | 6.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-86309 A flaw has been found in itsourcecode Sales and Inventory System 1.0. |
medium | 6.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86321 A vulnerability was found in java-json-tools jackson-coreutils 2.0. |
medium | 5.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-2390 The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting v... |
medium | 6.4 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-17509 The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL I... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-2520 The Online Scheduling and Appointment Booking System – Bookly plugin for WordPre... |
medium | 5.4 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-12757 The The Email Subscribers & Newsletters – Email Marketing, Post Notifications &... |
medium | 6.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-85517 A flaw has been found in code-projects Vehicle Management System 1.0. |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85522 A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85637 A security flaw has been discovered in jofpin trape 1.0.0/2.0. |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-18404 The Social Chat – Click To Chat App Button plugin for WordPress is vulnerable to... |
medium | 6.4 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-83628 The Theme My Login plugin for WordPress is vulnerable to Missing Authorization i... |
medium | 4.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-8623 The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for... |
medium | 6.4 | — | — | 2026-09-05 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.