September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-95292 Incorrect authorization in Safebrowsing in Google Chrome prior to 154.0.8037.57... |
medium | 4.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95293 Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.57 allowed a... |
medium | 4.7 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-86556 There is an information disclosure vulnerability in ZTE U30 Air. |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-95320 Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allo... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95323 UI misrepresentation in Chromium in Google Chrome on on iOS prior to 154.0.8037.... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-100143 The FluentCart A New Era of eCommerce WordPress plugin before 1.6.5 does not ver... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-75824 The User Frontend WordPress plugin before 4.3.12 does not check whether the site... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-80333 The Solace Extra WordPress plugin before 1.7.2 does not perform any authorizatio... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-83560 The New User Approve WordPress plugin before 3.2.10 does not properly verify aut... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-85001 The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of... |
medium | 6.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-85415 The Audio Player Block WordPress plugin before 1.6.3 does not validate the schem... |
medium | 6.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-85576 The All in One Files Upload WordPress plugin before 2.0.17 does not have any cap... |
medium | 4.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-86789 The Connections Business Directory WordPress plugin through 10.4.67 does not app... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-87777 The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize and escape a... |
medium | 6.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-89190 The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user'... |
medium | 4.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-90953 The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended... |
medium | 4.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-91051 The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenti... |
medium | 6.6 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-91072 The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-d... |
medium | 4.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-92424 The Content Egg WordPress plugin before 11.9.0 does not verify that a user runni... |
medium | 6.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-93580 The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94274 The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96886 The Course Booking System WordPress plugin before 7.0.9 does not restrict access... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-95336 Information leak in Transactions Platform in Google Chrome prior to 154.0.8037.5... |
medium | 6.5 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95346 UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allow... |
medium | 4.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95352 Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allo... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-92712 The ReactPress – Create React App for WordPress plugin for WordPress is vulnerab... |
medium | 6.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-88037 The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Sc... |
medium | 6.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-86157 Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere... |
medium | 5.6 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-86778 Observable response discrepancy vulnerability in Maksisoft Technology, IT, and S... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-6170 The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Sc... |
medium | 6.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-6171 The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Sc... |
medium | 6.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-6172 The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Sc... |
medium | 6.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-6173 The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Sc... |
medium | 6.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-62084 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-14876 The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scrip... |
medium | 6.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-16596 The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-11895 The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin f... |
medium | 6.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-100858 heym before 0.0.109 contains a server-side request forgery vulnerability in the... |
medium | 6.8 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100859 Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST... |
medium | 6.5 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100862 heym, a workflow automation platform, stores and returns multiple capability sec... |
medium | 4.9 | — | — | 2026-09-27 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.