September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86115 Sim before 0.8.14 classifies tool requests as internal based on URL prefix match... |
medium | 5.0 | — | — | 2026-09-05 | 2026-09-23 |
| CVE-2026-86116 Metabase versions before 0.63.1 fail to enforce data analyst permission checks o... |
medium | 6.5 | — | — | 2026-09-05 | 2026-09-24 |
| CVE-2026-86111 BookWyrm through 0.9.1 fails to validate user visibility permissions in the stat... |
medium | 6.5 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-76573 The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to... |
medium | 6.4 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-75018 The Custom Contact Forms plugin for WordPress is vulnerable to authorization byp... |
medium | 4.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-75586 The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Refle... |
medium | 6.1 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-85414 The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site... |
medium | 6.4 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84898 The Eventin WordPress plugin before 4.1.21 does not properly validate a template... |
medium | 6.6 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84899 The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84901 The Eventin WordPress plugin before 4.1.22 does not properly check authorization... |
medium | 4.9 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84930 The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84931 The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or es... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84936 The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization... |
medium | 5.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84937 The Video Player for YouTube WordPress plugin before 2.1.0 does not properly san... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-82846 The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape som... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-83543 The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied... |
medium | 4.1 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-83544 The Greenshift WordPress plugin before 13.2.0 does not properly escape a block a... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84021 The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84022 The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84221 The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifi... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84896 The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-78149 The Smart Post WordPress plugin before 4.0.8 does not check whether a post is pa... |
medium | 5.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-81423 The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a use... |
medium | 4.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-81424 The Accept Stripe Payments WordPress plugin before 2.1.4 does not verify that th... |
medium | 5.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-18843 The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable t... |
medium | 6.1 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-19861 The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2... |
medium | 4.7 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-3853 The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Script... |
medium | 6.4 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-4361 The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all... |
medium | 5.0 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-14975 The WP File Download plugin for WordPress is vulnerable to Directory Traversal i... |
medium | 6.5 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-15247 The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or... |
medium | 5.4 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-83628 The Theme My Login plugin for WordPress is vulnerable to Missing Authorization i... |
medium | 4.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-8623 The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for... |
medium | 6.4 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-8625 The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for... |
medium | 6.4 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2025-14945 The Events Manager - Calendar, Bookings, Tickets, and more! |
medium | 5.4 | — | — | 2026-09-05 | 2026-10-19 |
| CVE-2026-18404 The Social Chat – Click To Chat App Button plugin for WordPress is vulnerable to... |
medium | 6.4 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86137 In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka... |
medium | 6.1 | — | Xmlsoft / libxml2 | 2026-09-05 | 2026-09-15 |
| CVE-2026-52772 YesWiki is a wiki system written in PHP. |
medium | 5.5 | — | — | 2026-09-05 | 2026-09-09 |
| CVE-2026-52773 YesWiki is a wiki system written in PHP. |
medium | 6.1 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-52774 YesWiki is a wiki system written in PHP. |
medium | 6.1 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86100 Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when... |
medium | 6.4 | — | — | 2026-09-05 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.