September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,171
Critical
1,210
High
4,305
Medium
4,059
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-44639 NanoMQ is an MQTT broker. |
low | 3.7 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-84530 An information disclosure issue was addressed with improved memory management. |
low | 3.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-93384 Server-side request forgery in Omnibox in Google Chrome on on Android prior to 1... |
low | 3.7 | — | Google / chrome | 2026-09-17 | 2026-09-18 |
| CVE-2026-86893 A permissions issue was addressed with additional restrictions. |
low | 3.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-81922 Concrete CMS before 9.5.3 did not enforce a per-page authorization check when re... |
low | 2.7 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-18 |
| CVE-2026-81923 In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check... |
low | 2.7 | — | Concretecms / concrete cms | 2026-09-15 | 2026-09-18 |
| CVE-2026-65371 This issue was addressed with improved redaction of sensitive information. |
low | 3.3 | — | Apple / ipados | 2026-09-14 | 2026-09-18 |
| CVE-2026-86891 An authorization issue was addressed with improved state management. |
low | 3.5 | — | Apple / macos | 2026-09-14 | 2026-09-18 |
| CVE-2026-91723 Race condition in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed... |
low | 3.1 | — | Google / chrome | 2026-09-15 | 2026-09-18 |
| CVE-2026-92130 Jenkins Pipeline: Multibranch Plugin 841.vec5b_9e1806ec and earlier does not set... |
low | 3.1 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-20071 A vulnerability in the SSID bring-your-own-device (BYOD) onboarding workflow of... |
low | 3.8 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92418 A vulnerability was determined in ChangeWeDer crm up to c07bd4c97141521af6475034... |
low | 3.5 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-92472 A vulnerability was determined in GPAC 26.08-DEV. |
low | 3.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-92474 A security flaw has been discovered in GPAC 26.08-DEV. |
low | 3.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-73442 On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP... |
low | 3.0 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-91747 Use after free in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote... |
low | 3.1 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91730 Incomplete cleanup in GetUserMedia in Google Chrome prior to 153.0.8010.47 allow... |
low | 3.1 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91926 A flaw was found in gss-ntlmssp. |
low | 3.7 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-91782 A vulnerability was detected in GNU Binutils 2.47. |
low | 3.3 | — | Gnu / binutils | 2026-09-15 | 2026-09-17 |
| CVE-2026-91090 A vulnerability was determined in GPAC up to f1219cde. |
low | 3.9 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-91708 Race condition in Network in Google Chrome prior to 153.0.8010.47 allowed a remo... |
low | 3.1 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-89327 The FluentBoards WordPress plugin before 2.0.15 does not verify that a board mem... |
low | 3.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-89328 The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a... |
low | 3.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-86448 The LearnPress WordPress plugin before 4.4.7 does not perform any authentication... |
low | 3.7 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-84905 The Eventin WordPress plugin before 4.1.24 does not verify a user's capability t... |
low | 2.7 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-84907 The Eventin WordPress plugin before 4.1.24 does not properly authorise order fin... |
low | 3.7 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-82126 The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not... |
low | 2.7 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-18540 undici's retry interceptor can append the body of a ranged retry response to byt... |
low | 3.7 | — | Nodejs / undici | 2026-09-04 | 2026-09-16 |
| CVE-2026-75943 A brief (milliseconds to seconds) traffic leak may occur when an authenticated s... |
low | 2.6 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-75944 A race condition during supplicant re-authentication may leave a stale ACL entry... |
low | 2.6 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-75945 A race condition may cause a supplicant to remain in an authorized state after a... |
low | 2.6 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-77191 An authenticated supplicant on an adjacent network may bypass intended network a... |
low | 2.6 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-86763 Snipe-IT versions >= 7.0.12 and <= 8.6.3 contain an authorization bypass in the... |
low | 3.5 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-16 |
| CVE-2026-16592 The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization... |
low | 2.7 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-81159 Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allow... |
low | 3.7 | — | Centarro / commerce cybersource | 2026-09-02 | 2026-09-16 |
| CVE-2026-45761 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
low | 3.3 | — | Oisf / suricata | 2026-09-10 | 2026-09-16 |
| CVE-2026-90573 A vulnerability was identified in GPAC up to f1219cde. |
low | 3.3 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90568 A vulnerability was detected in moxi624 Mogu Blog v2 up to 5.2. |
low | 3.5 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90563 A vulnerability was determined in maliangnansheng bbs-springboot 3.0.0. |
low | 3.5 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2023-37252 An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. |
low | 3.1 | — | — | 2026-09-14 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.