September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,152
Critical
1,210
High
4,303
Medium
4,042
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-28660 In getAllSessions of multiple files, there is a possible confused deputy due to... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28652 In multiple functions of RangingServiceImpl.java, there is a possible MITM due t... |
low | 3.1 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28638 In multiple functions of XmpDataParser.java, there is a possible improper data s... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-82851 The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or... |
low | 2.7 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-84025 The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on seve... |
low | 2.2 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-86407 The User Registration & Membership WordPress plugin before 5.2.8 does not verify... |
low | 3.7 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90497 A vulnerability was determined in Fengoffice Feng Office up to 3.11.13.11. |
low | 3.5 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90502 A vulnerability was detected in stilleshan ServerStatus 1.0/2.0. |
low | 3.5 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90528 A flaw has been found in TDuckApp tduck-platform up to 5.3. |
low | 3.5 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90564 A vulnerability was identified in quequnlong shiyi-blog 1.0.0-1.2.1. |
low | 3.5 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90569 A flaw has been found in linlinjava litemall 1.5.0/1.6.0/1.7.0/1.8.0. |
low | 2.4 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90576 A security vulnerability has been detected in GPAC up to f1219cde. |
low | 3.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90602 A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.... |
low | 3.5 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90604 A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. |
low | 3.5 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90609 A vulnerability has been found in GPAC up to f1219cde. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90612 A vulnerability was identified in GPAC up to f1219cde. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90623 A weakness has been identified in andreashappe cochise up to 0.4.1. |
low | 3.7 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90681 A weakness has been identified in Matthias-Wandel jhead up to 3.3. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90684 A flaw has been found in GPAC up to f1219cde. |
low | 2.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90694 A vulnerability has been found in SourceCodester Inventory Management System 1.0... |
low | 3.5 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90696 A vulnerability was determined in SourceCodester Inventory Management System 1.0... |
low | 3.5 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90811 A weakness has been identified in cosmicstack-labs mercury-agent up to 1.2.0. |
low | 3.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-86740 Snipe-IT before 8.7.0 fails to check the return value of Storage::delete() in Up... |
low | 3.8 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-14 |
| CVE-2026-73318 XenForo before 2.3.13 contains a missing authorization vulnerability in the forc... |
low | 3.8 | — | Xenforo / xenforo | 2026-09-08 | 2026-09-14 |
| CVE-2026-78124 strongSwan 5.0.2 through 6.0.7 allows PKCS#7 certificate enumeration in the open... |
low | 3.7 | — | Strongswan / strongswan | 2026-09-11 | 2026-09-14 |
| CVE-2026-78127 libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory afte... |
low | 3.7 | — | Strongswan / strongswan | 2026-09-11 | 2026-09-14 |
| CVE-2026-78131 strongSwan 4.2.0 through 6.0.7 has a missing release of memory after its effecti... |
low | 3.7 | — | Strongswan / strongswan | 2026-09-11 | 2026-09-14 |
| CVE-2026-79729 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
low | 3.7 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-14 |
| CVE-2026-80175 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
low | 3.3 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-14 |
| CVE-2026-86231 A security flaw has been discovered in mwiede jsch up to 2.28.5. |
low | 3.7 | — | — | 2026-09-06 | 2026-09-11 |
| CVE-2026-79693 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
low | 3.4 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-11 |
| CVE-2026-48707 InstantCMS is a free and open source content management system. |
low | 3.1 | — | — | 2026-09-08 | 2026-09-11 |
| CVE-2026-73317 XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP... |
low | 2.7 | — | Xenforo / xenforo | 2026-09-08 | 2026-09-11 |
| CVE-2026-86779 The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-d... |
low | 2.7 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-11765 Improper neutralization of argument delimiters in a command ('argument injection... |
low | 3.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-75726 Adobe Experience Manager is affected by an Improper Input Validation vulnerabili... |
low | 3.5 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-86776 KeePass versions 2.35 through 2.61.1 fail to validate KDBX header field sizes be... |
low | 3.3 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-84969 A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C... |
low | 3.7 | — | Mongodb / c driver | 2026-09-03 | 2026-09-10 |
| CVE-2026-87525 Out of bounds read in Chromoting in Google Chrome on on Windows prior to 153.0.8... |
low | 2.7 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87442 Confused deputy in Prerender in Google Chrome prior to 153.0.8010.36 allowed a r... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.