September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-96775 MLflow's dspy flavor, versions >= 2.0, applies the MLFLOW_ALLOW_PICKLE_DESERIALI... |
high | 8.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95927 A vulnerability was identified in SourceCodester Online Reviewer Management Syst... |
high | 7.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-80047 A vulnerability in Hugging Face Transformers (versions 4.57.0 to 5.16.1) allows... |
high | 7.8 | — | — | 2026-09-01 | 2026-09-23 |
| CVE-2022-4997 The jet-form-builder-stripe-gateway WordPress plugin before 1.1.0 does not sanit... |
high | 8.6 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-14321 The divi-dash WordPress plugin before 1.0.7 does not validate the source of the... |
high | 8.2 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-86608 The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisati... |
high | 8.2 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93508 The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict... |
high | 8.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-50275 The Datadog PHP Tracer provides application performance monitoring and distribut... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-77239 WACRM is a self-hostable CRM template for WhatsApp. |
high | 8.1 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-61721 FluidSynth is a software synthesizer based on the SoundFont 2 specifications. |
high | 8.0 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-61819 pg_partman is a PostgreSQL extension that manages partitioned tables by time or... |
high | 8.5 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-94462 Spree is an open source e-commerce solution built with Ruby on Rails. |
high | 7.1 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-58268 SIPGO is a library for writing SIP services in the GO language. |
high | 7.5 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-59991 psd-tools is a Python package for working with Adobe Photoshop PSD files. |
high | 7.5 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-77322 SIPGO is a library for writing SIP services in the GO language. |
high | 7.5 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-61685 ReactPress is a publishing system for React developers. |
high | 7.5 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-31377 An Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-89281 The Apache Lounge Windows distribution of Apache HTTP Server build contains a ha... |
high | 8.4 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-94574 A local cross-user code execution vulnerability exists in GNU wget (Windows buil... |
high | 7.8 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-19438 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-42801 NULL pointer dereference vulnerability in ASR Crane，Falcon on Linux (as_rrc mod... |
high | 7.4 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-87254 Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component:... |
high | 7.5 | — | Oracle / agile product lifecycle management | 2026-09-15 | 2026-09-23 |
| CVE-2026-87256 Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component:... |
high | 7.7 | — | Oracle / agile product lifecycle management | 2026-09-15 | 2026-09-23 |
| CVE-2026-87257 Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component:... |
high | 7.7 | — | Oracle / agile product lifecycle management | 2026-09-15 | 2026-09-23 |
| CVE-2026-87258 Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component:... |
high | 7.6 | — | Oracle / agile product lifecycle management | 2026-09-15 | 2026-09-23 |
| CVE-2026-83621 ntopng is a web-based network traffic monitoring application. |
high | 8.1 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-92604 Scirius through 3.8.0 contains an arbitrary file write vulnerability in the PCAP... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92753 PatrowlManager through 1.8.4 contains an authorization bypass vulnerability in t... |
high | 7.1 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92783 Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/r... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-82412 ntopng is a web-based network traffic monitoring application. |
high | 8.8 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-92566 DataGear through 6.0.0 contains a server-side request forgery vulnerability in t... |
high | 8.2 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92749 SafeLine through 9.4.1 derives the management console session-signing secret fro... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92751 CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allow... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92752 metasfresh DocumentAttachmentsRestController and CommentsRestController endpoint... |
high | 8.3 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92761 WebVirtCloud fails to properly validate permission flags in UserInstance grants,... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92773 Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a G... |
high | 7.1 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92801 cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the on... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-95654 Databasement before 1.7.14 validates invitation tokens only when the acceptance... |
high | 7.4 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-90562 LangBot before 4.10.11 generates password recovery keys with only 24 bits of ent... |
high | 8.1 | — | — | 2026-09-13 | 2026-09-23 |
| CVE-2026-90768 CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpo... |
high | 8.1 | — | — | 2026-09-13 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.