September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-81769 Incorrect Privilege Assignment vulnerability in LiquidThemes Booking Hub allows... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-81775 Unauthenticated Cross Site Scripting (XSS) in Estatik <= 4.3.4 versions. |
high | 7.1 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-14982 The WP File Download plugin for WordPress is vulnerable to arbitrary file deleti... |
high | 8.1 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-84640 A maliciously constructed mail header could lead to a one byte read past the end... |
high | 7.5 | — | Mozilla / thunderbird | 2026-09-01 | 2026-09-03 |
| CVE-2026-84641 A malicious IMAP server can trigger use-after-free and heap-memory disclosure by... |
high | 7.5 | — | Mozilla / thunderbird | 2026-09-01 | 2026-09-03 |
| CVE-2026-84642 The values of the mail.allowed_attachment_hostnames advanced config setting were... |
high | 7.5 | — | Mozilla / thunderbird | 2026-09-01 | 2026-09-03 |
| CVE-2026-84130 Information disclosure in the Graphics: WebGPU component. |
high | 7.5 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84132 Information disclosure in the Networking: HTTP component. |
high | 7.5 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84836 Subscriber Insecure Direct Object References (IDOR) in WC Ukraine Shipping <= 1.... |
high | 7.1 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84773 Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.6 vers... |
high | 7.2 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84777 Unauthenticated Broken Authentication in Really Simple SSL <= 9.8.0 versions. |
high | 7.4 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84779 Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Ag... |
high | 8.1 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84765 Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT <= 7.5.1 versions... |
high | 7.1 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84757 Unauthenticated Settings Change in WP Compress <= 7.21.28 versions. |
high | 8.2 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84752 Contributor PHP Object Injection in RTMKit <= 2.1.5 versions. |
high | 8.8 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-81300 Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 <=... |
high | 7.1 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-81292 Unauthenticated Cross Site Scripting (XSS) in Simple Payment <= 2.5.1 versions. |
high | 7.1 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2021-38489 HDD password plaintext is stored in a UEFI variable. |
high | 8.2 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-19116 The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-19453 The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capab... |
high | 7.1 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-19723 The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.... |
high | 7.1 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-77792 The RegistrationMagic WordPress plugin before 6.0.9.9 does not escape a registra... |
high | 7.5 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-80467 The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not re... |
high | 8.1 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81737 The FAQ Builder AYS WordPress plugin before 1.8.5 does not sanitize or escape co... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81807 The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat messa... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-82183 The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the ident... |
high | 8.1 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-12526 The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not ve... |
high | 8.1 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-12865 The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two re... |
high | 7.1 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84350 Use after free in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84351 Buffer overflow in GPU in Google Chrome on on Windows prior to 152.0.7977.75 all... |
high | 8.3 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-85105 A flaw has been found in NousResearch hermes-agent 0.18.0. |
high | 7.3 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-85110 A vulnerability was identified in Tenda HG10 300001138. |
high | 8.8 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-85138 A vulnerability was detected in SeaCMS up to 13.6. |
high | 7.3 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84347 Use after free in WebRTC in Google Chrome prior to 152.0.7977.75 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-51788 An issue in cleverange_auth v.0.1.10 allows a remote attacker to cause a denial... |
high | 7.5 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-84349 Use after free in Browser in Google Chrome prior to 152.0.7977.75 allowed a remo... |
high | 8.3 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84647 In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, inc... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84649 In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), e... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84665 Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes f... |
high | 8.0 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84667 Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's back... |
high | 7.1 | — | — | 2026-09-02 | 2026-09-03 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.