September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-42323 Piwigo is a full featured open source photo gallery application for the web. |
high | 7.2 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-100708 Froxlor before 2.3.13 returns the ssl_key_file column — which stores the raw PEM... |
high | 7.1 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-96524 The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly ve... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-96532 The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capabi... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-97865 A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. |
high | 7.3 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-97871 A vulnerability has been found in Zhonglun CloudPos up to 3.0.1.76. |
high | 7.3 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-97877 A vulnerability was determined in zhistaredu StarTraining up to 3.8.1. |
high | 7.3 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-97878 A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. |
high | 7.3 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-97883 A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Pr... |
high | 7.3 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-97885 A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098... |
high | 7.3 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-77203 The Groups – Memberships and Access Control plugin for WordPress is vulnerable t... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100746 A vulnerability was found in coollabsio Coolify up to 4.1.0. |
high | 7.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100874 A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098... |
high | 7.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100875 A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to... |
high | 7.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100889 A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. |
high | 7.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100893 A vulnerability was determined in Privoce VoceChat Server up to 0.5.36. |
high | 7.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100901 A vulnerability was found in athlon1600 youtube-downloader up to 4.0.1. |
high | 7.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100908 A vulnerability has been found in Eyeplus 57.0.0.0308. |
high | 7.5 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100909 A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. |
high | 7.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101005 A vulnerability was detected in October CMS up to 4.3.4. |
high | 7.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101007 A vulnerability has been found in aaPanel BaoTa up to 11.8.0. |
high | 8.4 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101013 A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Pr... |
high | 7.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101053 A vulnerability was determined in Thinkware U3000 up to 1.02.04. |
high | 7.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101014 A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. |
high | 7.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-83330 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Web... |
high | 7.5 | — | Oracle / helidon | 2026-09-15 | 2026-09-28 |
| CVE-2026-83281 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: hel... |
high | 7.5 | — | Oracle / helidon | 2026-09-15 | 2026-09-28 |
| CVE-2026-83280 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: hel... |
high | 7.5 | — | Oracle / helidon | 2026-09-15 | 2026-09-28 |
| CVE-2026-83276 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: hel... |
high | 7.5 | — | Oracle / helidon | 2026-09-15 | 2026-09-28 |
| CVE-2026-49850 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
high | 7.5 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-50547 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
high | 7.5 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-77246 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 8.6 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-28 |
| CVE-2026-85134 Unrestricted upload of file with dangerous type vulnerability in Bimser Solution... |
high | 8.8 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82323 Authorization bypass through User-Controlled key vulnerability in Enocta Educati... |
high | 8.1 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82375 Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticate... |
high | 7.4 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82380 Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacke... |
high | 8.1 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82383 Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an un... |
high | 8.2 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100419 gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in... |
high | 7.0 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2024-14029 Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treat... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-28 |
| CVE-2026-76715 A vulnerability in an administrative component of Analytics and Location Engine... |
high | 7.1 | — | Arubanetworks / analytics and location engine | 2026-09-22 | 2026-09-28 |
| CVE-2026-76714 Vulnerabilities in the Analytics and Location Engine web interface allows remote... |
high | 7.2 | — | Arubanetworks / analytics and location engine | 2026-09-22 | 2026-09-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.