September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-62744 Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unaut... |
high | 8.8 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-28 |
| CVE-2026-93990 Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is fo... |
high | 7.5 | — | — | 2026-09-19 | 2026-09-28 |
| CVE-2026-97335 Incorrect authorization in the custom storage volume creation endpoint in Canoni... |
high | 7.7 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-90925 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 7.1 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-90926 Improper Control of Generation of Code ('Code Injection') vulnerability in Innot... |
high | 8.8 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100739 A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5d... |
high | 7.3 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100711 froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API k... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100660 Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.0.Final through 4.2.1... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100664 Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100672 The Comments plugin (getgrav/grav-plugin-comments) for Grav CMS through version... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100676 January, the media proxy/embed service of stoatchat (stoatchat/stoatchat), befor... |
high | 8.2 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100636 SiYuan versions before v3.8.4 contain a path traversal vulnerability in the expo... |
high | 7.6 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100599 OpenClaw versions 2026.5.1 through 2026.7.0 fail to apply the configured exec ap... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100314 A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Pr... |
high | 7.3 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-84095 The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capa... |
high | 8.0 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-84096 The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capa... |
high | 8.0 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-85081 The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin b... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-81655 The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict acces... |
high | 7.5 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-86609 The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape... |
high | 8.8 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-96795 Horilla is an HR and CRM software. |
high | 8.8 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-75907 The door access control on a Norwegian Cruise Line asset grants entry based only... |
high | 7.5 | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-5267 Ciena Navigator Network
Control Suite (NCS) contains an information exposure vul... |
high | 7.5 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-80357 Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contai... |
high | 7.0 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-69459 Heap-based buffer overflow in Windows Power Dependency Coordinator allows an aut... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-28 |
| CVE-2026-69460 Use after free in Windows Modern Device Management (MDM) allows an authorized at... |
high | 7.1 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-28 |
| CVE-2026-69462 Heap-based buffer overflow in Windows Error Reporting allows an authorized attac... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-69468 Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-69470 Use after free in Windows Connected User Experiences and Telemetry allows an aut... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-95655 Aureus ERP before 1.5.0 fails to scope message lookups to the current record in... |
high | 8.1 | — | — | 2026-09-22 | 2026-09-28 |
| CVE-2026-94609 authentik is an open-source identity provider. |
high | 8.8 | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-93659 Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields... |
high | 8.1 | — | — | 2026-09-18 | 2026-09-28 |
| CVE-2026-19477 There
is stack-based buffer overflow vulnerability recently discovered in MCC Un... |
high | 7.8 | — | — | 2026-09-17 | 2026-09-28 |
| CVE-2026-21086 Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows lo... |
high | 7.8 | — | Samsung / android | 2026-09-09 | 2026-09-28 |
| CVE-2026-95847 Moquette is a lightweight Java MQTT broker. |
high | 7.5 | — | Moquette / moquette | 2026-09-23 | 2026-09-28 |
| CVE-2026-83439 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: hel... |
high | 8.1 | — | Oracle / helidon | 2026-09-15 | 2026-09-28 |
| CVE-2026-100705 Kyverno before 1.19.1 is vulnerable to server-side request forgery. |
high | 7.6 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-96896 The Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin before 19... |
high | 7.2 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-93435 redis-parser through 3.0.0 contains a denial of service vulnerability in the RES... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-28 |
| CVE-2026-93349 Frictionless before 5.19.1 contains an OS command injection vulnerability in the... |
high | 8.8 | — | — | 2026-09-23 | 2026-09-28 |
| CVE-2026-85056 ZITADEL is an open source identity management platform. |
high | 8.2 | — | — | 2026-09-24 | 2026-09-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.