September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-58846 In kvm_iommu_map_sg of iommu.c, there is a possible use after free due to a miss... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-58848 In multiple functions of alloc.c, there is a possible unauthorized read/write ac... |
high | 7.0 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-93759 Mongoid does not neutralize a string-typed query criterion supplied to its query... |
high | 8.6 | — | Mongodb / mongoid | 2026-09-18 | 2026-09-24 |
| CVE-2026-96898 A vulnerability was detected in yhx070424 ShopXO up to 2.2.7. |
high | 7.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96601 A vulnerability was detected in Abdurrab5 online-makeup-store. |
high | 7.3 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-61570 MPXJ is an open source library to read and write project plans from a variety of... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-63203 Logto is the modern, open-source auth infrastructure for SaaS and AI apps. |
high | 7.6 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-93760 Mongoid does not restrict which query operators may come from caller-supplied fi... |
high | 8.2 | — | Mongodb / mongoid | 2026-09-18 | 2026-09-24 |
| CVE-2026-93761 An inefficient regular expression complexity issue in the in-memory query evalua... |
high | 7.5 | — | Mongodb / mongoid | 2026-09-18 | 2026-09-24 |
| CVE-2026-45528 In getManageSpaceActivityIntent of StorageManagerService.java, there is a possib... |
high | 7.3 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-49918 In multiple functions, there is a possible out of bounds write due to an integer... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-49919 In tt_face_colr_blend_layer of ttcolr.c, there is a possible remote code executi... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-49927 In multiple locations, there is a possible out of bounds write due to an integer... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-49932 In parseParts of PduParser.java, there is a possible out of bounds read due to a... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-69386 Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unaut... |
high | 8.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-24 |
| CVE-2026-45515 In a2dp_vendor_opus_decoder_decode_packet of a2dp_vendor_opus_decoder.cc, there... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-69388 Use after free in Windows Bluetooth Service allows an authorized attacker to ele... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-24 |
| CVE-2026-45520 In onAttach of BiometricsSettingsBase.java, there is a possible authentication b... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-97182 A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. |
high | 7.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-85682 The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in al... |
high | 8.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-56736 phpMyFAQ is an open source FAQ web application. |
high | 8.2 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-69322 Double free in Microsoft Windows Search Component allows an authorized attacker... |
high | 8.0 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69328 Untrusted search path in Windows Storage allows an authorized attacker to elevat... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-44236 rabbitmq-c is a C-language AMQP client library for RabbitMQ. |
high | 7.1 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-96826 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-69377 Missing authorization in Windows Modern Device Management (MDM) allows an author... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-24 |
| CVE-2026-15027 CGServiSign developed by Changing has a OS Command Injection vulnerability. |
high | 8.8 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96556 A flaw has been found in Neethuharii CafeManagement. |
high | 7.3 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96603 A vulnerability has been found in Abdurrab5 online-makeup-store. |
high | 7.3 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-19125 The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication B... |
high | 8.1 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-86583 The Import and export users and customers plugin for WordPress is vulnerable to... |
high | 8.8 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-80513 The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes m... |
high | 7.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-88843 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not val... |
high | 7.2 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96803 A vulnerability was identified in java110 MicroCommunity up to 2.0. |
high | 7.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-77193 The eesy_ID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Pa... |
high | 7.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-94144 A flaw has been found in drogonframework drogon up to 1.9.13. |
high | 7.3 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-12370 ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Man... |
high | 7.6 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-92239 A maliciously constructed IMAP line could cause an out-of-bounds buffer read. |
high | 8.1 | — | Mozilla / thunderbird | 2026-09-15 | 2026-09-24 |
| CVE-2026-69279 Use after free in Windows Cloud Files Mini Filter Driver allows an authorized at... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69281 Use after free in Windows License Manager allows an authorized attacker to eleva... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.