September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,152
Critical
1,210
High
4,303
Medium
4,042
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-18743 A flaw was found in popt. |
low | 2.5 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-85592 phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the ques... |
low | 3.7 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-86670 A flaw has been found in aircheng-org iWebShop-5 up to 5.15. |
low | 3.7 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-84066 The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPr... |
low | 3.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-58234 SAP Process Integration (SOAP Adapter) allows a privileged user to send speciall... |
low | 2.2 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-76960 SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cr... |
low | 3.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-78150 The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership... |
low | 2.7 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-81348 The My Private Site WordPress plugin before 4.2.3 does not apply its site-privac... |
low | 3.7 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84225 The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to... |
low | 2.2 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84745 The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-publi... |
low | 2.7 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84926 The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access... |
low | 2.7 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84927 The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient autho... |
low | 2.7 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86644 A vulnerability was determined in star7th showdoc up to 3.9.1. |
low | 3.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-86226 A security flaw has been discovered in Projectwolds Online Attendance System 1.0... |
low | 3.5 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-85052 Out of bounds read in CrashReporting in Google Chrome prior to 152.0.7977.82 all... |
low | 3.1 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-86485 In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed f... |
low | 3.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86486 In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed... |
low | 3.7 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86487 In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed re... |
low | 3.1 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86491 In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project an... |
low | 3.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86501 In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be writt... |
low | 2.8 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86503 In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could tr... |
low | 3.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86505 In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked pr... |
low | 3.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-45197 Kernel software installed and running inside a Guest VM may post improper comman... |
low | 2.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-86301 A vulnerability has been found in code-projects Hospital Information System 1.0. |
low | 3.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-85207 A vulnerability was identified in itsourcecode Online Medicine Delivery System 1... |
low | 3.5 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-85030 A vulnerability has been found in HKUDS AI-Trader up to d03ff6c056b32ced735adf7c... |
low | 3.7 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-78600 Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to un... |
low | 3.5 | — | Elastic / elastic cloud on kubernetes | 2026-09-02 | 2026-09-03 |
| CVE-2026-78587 Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of servic... |
low | 3.1 | — | Elastic / fleet server | 2026-09-02 | 2026-09-03 |
| CVE-2026-77783 The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post... |
low | 3.7 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-77784 The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is... |
low | 2.7 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-77785 The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the reque... |
low | 2.7 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-77787 The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability... |
low | 2.7 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81196 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not pro... |
low | 2.7 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81198 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not pro... |
low | 3.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-14326 The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownersh... |
low | 3.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-19698 The GutenKit WordPress plugin before 2.5.1 does not validate or escape style set... |
low | 3.5 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2023-3360 The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of... |
low | 3.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84355 Incorrect authorization in Navigation in Google Chrome prior to 152.0.7977.75 al... |
low | 3.1 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-85022 A vulnerability was identified in langgenius dify 1.13.0. |
low | 3.5 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84359 Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remot... |
low | 3.1 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.