September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86303 A vulnerability was determined in 92181 markdown up to 058cab0cb7fb245a0ccc6b844... |
high | 7.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-12483 The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type U... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-18406 The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plug... |
high | 7.2 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-78438 The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scrip... |
high | 7.2 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-81543 The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Pri... |
high | 8.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-83625 The Contact Form by Supsystic plugin for WordPress is vulnerable to Stored Cross... |
high | 7.2 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-18056 The HivePress Authentication plugin for WordPress is vulnerable to Authenticatio... |
high | 7.5 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-48888 Allocation of Resources Without Limits or Throttling vulnerability in Automattic... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-81781 Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce... |
high | 7.1 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-81790 Missing Authorization vulnerability in Viszt Péter Csomagpontok és szállítási cí... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-81798 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-81806 Server-Side Request Forgery (SSRF) vulnerability in John Darrel Hide My WP Ghost... |
high | 7.2 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-84817 Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.1 versions... |
high | 7.1 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-84818 Unauthenticated Cross Site Scripting (XSS) in Open User Map <= 1.4.50 versions. |
high | 7.1 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-84820 Unauthenticated Cross Site Scripting (XSS) in Unlimited Elements For Elementor (... |
high | 7.1 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-19118 A time-of-check time-of-use race condition vulnerability was identified in GitHu... |
high | 7.5 | — | Github / enterprise server | 2026-09-01 | 2026-09-08 |
| CVE-2026-76851 A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Ente... |
high | 8.8 | — | Github / enterprise server | 2026-09-01 | 2026-09-08 |
| CVE-2026-80753 In the Linux kernel, the following vulnerability has been resolved:
ovpn: run d... |
high | 8.4 | — | — | 2026-09-03 | 2026-09-07 |
| CVE-2026-84756 Subscriber Privilege Escalation in WCFM Membership <= 2.11.11 versions. |
high | 7.1 | — | — | 2026-09-03 | 2026-09-07 |
| CVE-2026-84763 Unauthenticated Cross Site Scripting (XSS) in RTMKit <= 2.1.5 versions. |
high | 7.1 | — | — | 2026-09-03 | 2026-09-07 |
| CVE-2026-84778 Unauthenticated Denial of Service Attack in Migrate Guru – Site Migration & Clon... |
high | 7.5 | — | — | 2026-09-03 | 2026-09-07 |
| CVE-2026-81295 Unauthenticated Cross Site Scripting (XSS) in Under Construction <= 5.82 version... |
high | 7.1 | — | — | 2026-09-03 | 2026-09-07 |
| CVE-2026-85225 A vulnerability was identified in code-projects Doctor Appointment System 1.0. |
high | 7.3 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-85137 A security vulnerability has been detected in SeaCMS up to 13.6. |
high | 7.3 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-84812 Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 vers... |
high | 7.1 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-84847 Unauthenticated Broken Access Control in Quick Event Manager <= 9.17 versions. |
high | 7.5 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-81773 Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension... |
high | 7.1 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-84841 A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. |
high | 7.3 | — | — | 2026-09-02 | 2026-09-05 |
| CVE-2026-52022 An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a deni... |
high | 7.5 | — | Kamailio / kamailio | 2026-09-01 | 2026-09-04 |
| CVE-2026-52130 llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/jso... |
high | 7.5 | — | Ggml / llama.cpp | 2026-09-01 | 2026-09-04 |
| CVE-2026-52131 llama.cpp b5693 and before has a Reachable Assertion via the gguf_reader::read f... |
high | 7.5 | — | Ggml / llama.cpp | 2026-09-01 | 2026-09-04 |
| CVE-2026-58566 Dell PowerStore, an Incorrect Authorization vulnerability. |
high | 8.8 | — | — | 2026-09-01 | 2026-09-04 |
| CVE-2023-20576 Insufficient Verification of Data Authenticity in AGESA™ may allow an attacker t... |
high | 7.7 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2023-20577 A heap overflow in SMM module may allow an attacker with access to a second vuln... |
high | 7.4 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-52132 llama.cpp through commit 97f06e9, when started with the --reranking flag, allows... |
high | 7.5 | — | Ggml / llama.cpp | 2026-09-01 | 2026-09-04 |
| CVE-2026-85208 A security flaw has been discovered in itsourcecode Online Medicine Delivery Sys... |
high | 7.3 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-85380 A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d... |
high | 7.3 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-85398 A vulnerability was identified in code-projects Hospital Information System 1.0. |
high | 7.3 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-57777 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-78604 Incorrect Permission Assignment for Critical Resource (CWE-732) in Elastic Agent... |
high | 7.8 | — | Elastic / elastic agent | 2026-09-02 | 2026-09-04 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.