September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-81348 The My Private Site WordPress plugin before 4.2.3 does not apply its site-privac... |
low | 3.7 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2025-15693 The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a dire... |
low | 2.7 | — | — | 2026-09-05 | 2026-10-19 |
| CVE-2025-15694 The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and e... |
low | 3.5 | — | — | 2026-09-05 | 2026-10-19 |
| CVE-2026-86141 xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewPa... |
low | 3.3 | — | Xmlsoft / libxml2 | 2026-09-05 | 2026-09-15 |
| CVE-2026-85704 A security flaw has been discovered in ramon-victor freegpt-webui up to 098db3df... |
low | 3.7 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-18540 undici's retry interceptor can append the body of a ranged retry response to byt... |
low | 3.7 | — | Nodejs / undici | 2026-09-04 | 2026-09-16 |
| CVE-2026-17483 IBM Db2 Mirror for i 7.4, 7.5, and 7.6 IBM i could allow a local attacker to del... |
low | 3.3 | — | Ibm / db2 mirror for i | 2026-09-04 | 2026-09-10 |
| CVE-2026-85592 phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the ques... |
low | 3.7 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-84066 The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPr... |
low | 3.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85405 A flaw has been found in Eleveo Call Recording Software 9.7.0. |
low | 3.5 | — | — | 2026-09-04 | 2026-10-20 |
| CVE-2026-85406 A vulnerability has been found in Eleveo Quality Management 9.7.0. |
low | 3.5 | — | — | 2026-09-04 | 2026-10-20 |
| CVE-2026-45197 Kernel software installed and running inside a Guest VM may post improper comman... |
low | 2.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85207 A vulnerability was identified in itsourcecode Online Medicine Delivery System 1... |
low | 3.5 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-85052 Out of bounds read in CrashReporting in Google Chrome prior to 152.0.7977.82 all... |
low | 3.1 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-49456 Waku is the minimal React framework. |
low | 3.1 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-84969 A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C... |
low | 3.7 | — | Mongodb / c driver | 2026-09-03 | 2026-09-10 |
| CVE-2026-85022 A vulnerability was identified in langgenius dify 1.13.0. |
low | 3.5 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-85030 A vulnerability has been found in HKUDS AI-Trader up to d03ff6c056b32ced735adf7c... |
low | 3.7 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-84653 Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both... |
low | 3.5 | — | Jenkins / jenkins | 2026-09-02 | 2026-09-15 |
| CVE-2026-63020 A vulnerability exists in an undisclosed BIG-IP Configuration utility page that... |
low | 3.1 | — | F5 / big-ip access policy manager | 2026-09-02 | 2026-09-15 |
| CVE-2026-78600 Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to un... |
low | 3.5 | — | Elastic / elastic cloud on kubernetes | 2026-09-02 | 2026-09-03 |
| CVE-2026-78587 Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of servic... |
low | 3.1 | — | Elastic / fleet server | 2026-09-02 | 2026-09-03 |
| CVE-2026-14326 The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownersh... |
low | 3.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-19698 The GutenKit WordPress plugin before 2.5.1 does not validate or escape style set... |
low | 3.5 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2025-15692 The Icegram Express WordPress plugin before 5.8.6 does not properly escape a lis... |
low | 3.5 | — | — | 2026-09-02 | 2026-10-19 |
| CVE-2023-3360 The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of... |
low | 3.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81168 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal... |
low | 3.7 | — | Captcha Protected Page Project / captcha protected page | 2026-09-02 | 2026-09-09 |
| CVE-2026-81159 Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allow... |
low | 3.7 | — | Centarro / commerce cybersource | 2026-09-02 | 2026-09-16 |
| CVE-2026-81161 Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation... |
low | 3.3 | — | Content Moderation Notifications Project / content moderation notifications | 2026-09-02 | 2026-09-24 |
| CVE-2026-81196 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not pro... |
low | 2.7 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81198 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not pro... |
low | 3.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-77783 The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post... |
low | 3.7 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-77784 The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is... |
low | 2.7 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-77785 The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the reque... |
low | 2.7 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-77787 The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability... |
low | 2.7 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84437 A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. |
low | 3.5 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84438 A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. |
low | 3.5 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84355 Incorrect authorization in Navigation in Google Chrome prior to 152.0.7977.75 al... |
low | 3.1 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84359 Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remot... |
low | 3.1 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84328 Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allo... |
low | 3.1 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.