September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-80231 A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup
for... |
high | 7.5 | — | Haxx / curl | 2026-09-06 | 2026-09-15 |
| CVE-2026-80255 A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of
space... |
high | 7.5 | — | Haxx / curl | 2026-09-06 | 2026-09-15 |
| CVE-2026-13608 A flaw in the libcurl SASL negotiation for LDAP authentication allows an
incompl... |
high | 7.4 | — | Haxx / curl | 2026-09-06 | 2026-09-15 |
| CVE-2026-63427 An authentication bypass vulnerability was discovered in Lenovo Software Fix tha... |
high | 7.8 | — | — | 2026-09-10 | 2026-09-15 |
| CVE-2026-87608 Improper certificate validation in FedCM in Google Chrome prior to 153.0.8010.36... |
high | 7.5 | — | Google / chrome | 2026-09-09 | 2026-09-14 |
| CVE-2026-15891 The MQTT-SN client keepalive handler process_ping() in subsys/net/lib/mqtt_sn/mq... |
high | 7.5 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-77705 The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10... |
high | 7.2 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-77752 The Temporary Login Without Password WordPress plugin before 1.9.9 does not veri... |
high | 7.2 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-80491 The SAMO Forms WordPress plugin through 1.0.0 does not properly sanitise and esc... |
high | 8.6 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-80494 The Yogeta WP Cloud WordPress plugin through 1.0 does not validate a user-suppli... |
high | 8.6 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-81090 The Gpx2Graphics WordPress plugin through 0.3 does not perform a CSRF check when... |
high | 7.2 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-81429 The Export & Import WPBakery Page Builder WordPress plugin through 1.0.2 does no... |
high | 7.1 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-81742 The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any author... |
high | 8.8 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-84047 The Album Cover Finder WordPress plugin through 0.7.0 does not properly sanitize... |
high | 8.6 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-84099 The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthen... |
high | 8.1 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-87759 The Add User Autocomplete WordPress plugin before 1.2 does not perform any capab... |
high | 8.8 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-87842 The Zonify WordPress plugin before 1.0.5 does not perform any capability or auth... |
high | 7.5 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-87888 The YayPricing WordPress plugin before 3.5.7 does not perform an authorization c... |
high | 8.0 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-80071 The User Registration & Membership WordPress plugin before 5.2.8 does not proper... |
high | 7.2 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-86406 The User Registration & Membership WordPress plugin before 5.2.8 does not check... |
high | 7.5 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-89080 The Really Simple Security WordPress plugin before 9.8.1 does not prevent an una... |
high | 7.5 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-74933 The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisatio... |
high | 8.8 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-85129 The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or vali... |
high | 8.8 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-88793 The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any author... |
high | 8.8 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-88802 The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events... |
high | 7.5 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-89023 ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missin... |
high | 8.6 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-72524 Incorrect Authorization vulnerability in Apache Doris allows an authenticated us... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-87779 Insertion of sensitive information into log file vulnerability in Apache Syncope... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-73178 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apac... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-78336 Insertion of sensitive information into sent data vulnerability in Apache Syncop... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-73195 Improper Encoding or Escaping of Output vulnerability in Apache Syncope. |
high | 7.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-73236 Incorrect Authorization vulnerability in Apache Syncope. |
high | 7.5 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-82427 Description
A topology's `topology.blobstore.map` lets the submitter choose a l... |
high | 7.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-82428 Description
Dependency artifacts uploaded with `storm jar --artifacts` were sto... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-82429 Description
The setuid-root `worker-launcher` binary adjusts ownership and perm... |
high | 7.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-82430 Description
When launching a Docker or OCI worker, the setuid-root `worker-laun... |
high | 7.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-82432 Description
Nimbus validated `topology.blobstore.map` against the calling subje... |
high | 8.1 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-82438 Description
Three separate mechanisms allowed a web page on an unrelated origin... |
high | 8.1 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90495 A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. |
high | 7.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90510 A security vulnerability has been detected in dromara orion-visor up to 2.5.7. |
high | 8.3 | — | — | 2026-09-13 | 2026-09-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.