September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-85577 AVideo through commit c91b5975d contains a reflected cross-site scripting vulner... |
medium | 5.4 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85578 SiYuan through 3.8.1 contains an authorization bypass vulnerability in the /api/... |
medium | 6.5 | — | — | 2026-09-04 | 2026-10-08 |
| CVE-2026-85579 SiYuan is affected by an information disclosure vulnerability (confirmed in v3.8... |
medium | 4.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85580 SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the M... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-19043 Missing Authorization vulnerability in Menulux Software Inc. |
medium | 4.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-18957 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 5.4 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-84045 The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 doe... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85534 A flaw was found in libsoup. |
medium | 5.9 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-27347 Missing Authorization vulnerability in Crocoblock JetPopup allows Exploiting Inc... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-85541 DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerabi... |
medium | 5.4 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-81666 An integer overflow was found in Corosync's handling of membership commit token... |
medium | 6.5 | — | — | 2026-09-04 | 2026-10-21 |
| CVE-2026-84043 The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does no... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-84044 The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not ve... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-27086 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-07 |
| CVE-2026-85311 Missing Authorization vulnerability in Kings Plugins MarketKing allows Exploitin... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-07 |
| CVE-2026-85528 Improper input validation of the auto-configuration account identifier in Snowfl... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-27432 Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vi... |
medium | 5.4 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-32480 Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiti... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-6217 Use of a One-Way hash without a salt vulnerability in Pik Online Software Soluti... |
medium | 6.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-80190 Apache Allura: stored XSS via SVN code repositories. |
medium | 6.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85229 ** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of input during web page... |
medium | 6.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-84146 The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-79632 The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-80180 Stored XSS via markdown HTML processing in Apache Allura. |
medium | 6.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-80438 The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilit... |
medium | 5.9 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-81347 The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not proper... |
medium | 5.9 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-82186 The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate... |
medium | 4.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-82193 The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does n... |
medium | 5.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-82194 The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does n... |
medium | 5.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-71216 PagerDuty alarm hook transmits the integration routing key over cleartext HTTP. |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-74853 The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a dis... |
medium | 6.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-79630 The WPFunnels WordPress plugin before 3.13.0 does not verify that the product re... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-79631 The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-17517 The Content Views WordPress plugin before 4.5.1.2 does not check whether the use... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2025-15691 The WPFunnels WordPress plugin before 3.13.0 does not check whether user registr... |
medium | 5.3 | — | — | 2026-09-04 | 2026-10-19 |
| CVE-2026-85407 A vulnerability was found in Eleveo Quality Management 9.7.0. |
medium | 4.3 | — | — | 2026-09-04 | 2026-10-20 |
| CVE-2026-85408 A vulnerability was determined in Eleveo Quality Management 9.7.0. |
medium | 4.3 | — | — | 2026-09-04 | 2026-10-20 |
| CVE-2026-85409 A vulnerability was identified in Eleveo Quality Management 9.7.0. |
medium | 6.3 | — | — | 2026-09-04 | 2026-10-20 |
| CVE-2026-85149 SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentia... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85401 A weakness has been identified in Dolibarr up to 21.0.4/22.0.5/23.0.3. |
medium | 6.3 | — | — | 2026-09-04 | 2026-09-04 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.