September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,171
Critical
1,210
High
4,305
Medium
4,059
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2023-37253 An issue was discovered in the ProofreadPage extension for MediaWiki through 1.3... |
low | 3.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-86701 Android application "ManabiPocket for Parents" contains an improper access contr... |
low | 2.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-16190 IBM WebSphere Application Server 9.0, and 8.5 is affected by an authorization by... |
low | 3.1 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-19086 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a denial of service as a result of a bu... |
low | 3.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-89162 In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adv... |
low | 3.3 | — | Pcre / pcre2 | 2026-09-11 | 2026-09-16 |
| CVE-2026-91835 A vulnerability was detected in OpenClaw ClawScan up to 0.1.6. |
low | 2.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-90826 A vulnerability was determined in GPAC 26.07.0. |
low | 2.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-46460 Dell PowerScale OneFS, versions 9.5.0.0 through 9.7.1.15, versions 9.8.0.0 throu... |
low | 3.5 | — | Dell / powerscale onefs | 2026-09-09 | 2026-09-16 |
| CVE-2026-91781 A security vulnerability has been detected in GNU Binutils 2.47. |
low | 3.3 | — | Gnu / binutils | 2026-09-15 | 2026-09-16 |
| CVE-2026-91780 A weakness has been identified in GNU Binutils 2.47. |
low | 3.3 | — | Gnu / binutils | 2026-09-15 | 2026-09-16 |
| CVE-2026-91779 A security flaw has been discovered in GNU Binutils 2.47. |
low | 3.3 | — | Gnu / binutils | 2026-09-15 | 2026-09-16 |
| CVE-2026-90695 A vulnerability was found in SourceCodester Inventory Management System 1.0. |
low | 3.5 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90685 A vulnerability has been found in GPAC up to f1219cde. |
low | 2.8 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90613 A security flaw has been discovered in GPAC up to f1219cde. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90575 A weakness has been identified in PHPGurukul Small CRM 4.0. |
low | 3.7 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90570 A vulnerability has been found in linlinjava litemall 1.4.0/1.5.0/1.6.0/1.7.0/1.... |
low | 2.4 | — | — | 2026-09-13 | 2026-09-16 |
| CVE-2026-90825 A vulnerability was found in GPAC 26.07.0. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-86141 xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewPa... |
low | 3.3 | — | Xmlsoft / libxml2 | 2026-09-05 | 2026-09-15 |
| CVE-2026-90611 A vulnerability was determined in GPAC up to f1219cde. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90842 A weakness has been identified in PHPGurukul Blood Donor Management System 1.0. |
low | 3.7 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90622 A security flaw has been discovered in GNU libredwg 0.13.4. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90683 A vulnerability was detected in GPAC up to f1219cde. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-63020 A vulnerability exists in an undisclosed BIG-IP Configuration utility page that... |
low | 3.1 | — | F5 / big-ip access policy manager | 2026-09-02 | 2026-09-15 |
| CVE-2026-84653 Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both... |
low | 3.5 | — | Jenkins / jenkins | 2026-09-02 | 2026-09-15 |
| CVE-2026-90824 A vulnerability has been found in GPAC 26.07.0. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90529 A vulnerability has been found in DataEase up to 2.10.25/2.10.26. |
low | 3.5 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90567 A security vulnerability has been detected in quequnlong shiyi-blog up to 1.2.1. |
low | 3.5 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90503 A flaw has been found in Chengdu Qilu Technology Ludashi 6.1026.4715.714. |
low | 2.3 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90508 A security flaw has been discovered in Chengdu Qilu Technology Ludashi 6.1026.47... |
low | 3.4 | — | — | 2026-09-13 | 2026-09-15 |
| CVE-2026-90827 A vulnerability was identified in GPAC 26.07.0. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90835 A flaw has been found in michaelliao itranswarp up to 2.19. |
low | 3.5 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90845 A flaw has been found in PHPGurukul Daily Expense Tracker System 1.1. |
low | 3.5 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-90850 A vulnerability was detected in PHPGurukul Hostel Management System 3.0. |
low | 2.4 | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-28582 In onCreate of ConfirmDeviceCredentialActivity.java, there is a possible unautho... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-0054 In isCallerAllowed of WalletContextualLocationsService.kt, there is a possible w... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-90713 A security flaw has been discovered in vllm-project vLLM up to 0.29.0. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-90610 A vulnerability was found in GPAC up to f1219cde. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-15 |
| CVE-2026-28630 In onCreate of ContactsPickerActivity.kt, there is a possible misleading UI due... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28623 In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28622 In getQueryBuilderInternal of MediaProvider.java, there is a possible way to ret... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.