September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-81565 Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Uploa... |
not reported | — | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-81566 Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation... |
not reported | — | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-78081 Joomla Extension - j2commerce.com - Missing CSRF protection on cart, checkout an... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-81567 Joomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the s... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-81568 Joomla Extension - j2commerce.com - Arbitrary file read via `task=download` in J... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-82189 Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-82190 Joomla Extension - j2commerce.com - Predictable/forgeable order access token in... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-82191 Joomla Extension - j2commerce.com - Unescaped request data reflected into PayPal... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-78546 Out-of-bounds read vulnerability in Citirx Workspace app for Windows. |
not reported | — | — | — | 2026-09-11 | 2026-09-16 |
| CVE-2026-78547 Out-of-bounds write vulnerability in Citrix Citrix Workspace app for Windows. |
not reported | — | — | — | 2026-09-11 | 2026-09-16 |
| CVE-2026-18115 Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field edit_user_properties permi... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-81899 Concrete CMS 9.0.0 to 9.5.2 stored group folder names without sanitization and p... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-18421 Concrete CMS 9 through 9.5.2 does not perform an authorization check in three ac... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-68529 Concrete CMS 9.0.0 through 9.5.2 was missing an authorization check on the Expre... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-68530 Concrete CMS 9 through 9.5.2 did not perform an authorization check on several b... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-68531 Concrete CMS 9 before 9.5.3 did not escape SQL LIKE wildcard characters in the k... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-68533 Concrete CMS below 9.5.3 conversation attachment uploaded endpoint imported file... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-68534 Concrete CMS before 9.5.3 rendered Express entry labels as raw HTML when display... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-21588 This High severity DoS (Denial of Service) vulnerability was introduced in versi... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-92571 Rejected reason: CVE ID reserved in error and not assigned to a vulnerability. |
not reported | — | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-92002 Affected versions of MISP use Redis to throttle repeated authentication-failure... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91819 Affected versions of MISP rely on CakePHP request-method override processing in... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-76159 Incorrect Permission Assignment for Critical Resource in the configuration loade... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91825 Affected versions of MISP fail to authorize a submitted sharing group in a speci... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91846 Affected versions of MISP allow a collection element to be created from a bare U... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91851 Affected versions of MISP incorrectly filter dashboard templates that are restri... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91857 Affected versions of MISP expose several state-changing controller actions witho... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-91859 Affected versions of MISP can record incorrect access-log data for requests that... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-92003 Affected versions of MISP do not consistently apply the existing authentication-... |
not reported | — | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-90893 MISP contains a Cross-Site Request Forgery (CSRF) vulnerability in the UserSetti... |
not reported | — | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90895 Affected versions of MISP’s interactive CLI shell implement access control indep... |
not reported | — | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90955 Affected versions of MISP’s interactive CLI shell do not reliably preserve the i... |
not reported | — | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90957 Affected versions of MISP serve uploaded SVG images inline without a restrictive... |
not reported | — | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-90961 The LdapAuth and LinOTPAuth authentication plugins in MISP contain an authentica... |
not reported | — | — | — | 2026-09-14 | 2026-09-16 |
| CVE-2026-61396 Rejected reason: Did not need CVE ID |
not reported | — | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-66789 Rejected reason: This CVE ID was assigned in error as a duplicate of CVE-2026-70... |
not reported | — | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-66790 Rejected reason: This CVE ID was assigned in error as a duplicate of CVE-2026-70... |
not reported | — | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-87730 Rejected reason: this is rejected |
not reported | — | — | — | 2026-09-15 | 2026-09-15 |
| CVE-2026-67398 Missing authorization vulnerability has been discovered in 2Checkout payment gat... |
not reported | — | — | — | 2026-09-04 | 2026-09-14 |
| CVE-2013-1446 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-14 | 2026-09-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.