September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-97247 Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions. |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97079 Subscriber Insecure Direct Object References (IDOR) in Webba Booking <= 6.5.0 ve... |
medium | 4.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97236 Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions. |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97238 Subscriber Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions. |
medium | 5.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97239 Subscriber Broken Access Control in MCP Content Manager Lite <= 1.1.0 versions. |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97066 Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 ver... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97067 Contributor Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.7 versions... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97074 Subscriber Insecure Direct Object References (IDOR) in Newsletters, Email Market... |
medium | 4.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97078 Unauthenticated Insecure Direct Object References (IDOR) in Client Invoicing by... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96829 Contributor Cross Site Scripting (XSS) in The Plus Addons for Elementor Page Bui... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96834 Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions. |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96835 Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.85 v... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96821 Subscriber Privilege Escalation in FluentBoards <= 2.0.12 versions. |
medium | 6.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96824 Editor Arbitrary File Deletion in Template Kit – Import <= 1.0.16 versions. |
medium | 6.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96825 Subscriber Bypass Vulnerability in All In One WP Security & Firewall <= 5.4.8 ve... |
medium | 4.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96450 Contributor Cross Site Scripting (XSS) in pixfort Core < 4.3.3 versions. |
medium | 5.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96347 Subscriber Insecure Direct Object References (IDOR) in Bookly <= 28.2 versions. |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96338 Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 versions. |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94681 Unauthenticated Denial of Service Attack in WP Store Locator < 3.0.0 versions. |
medium | 5.9 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94672 Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versio... |
medium | 4.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94673 Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appo... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94674 Contributor Cross Site Scripting (XSS) in Pixel Manager for WooCommerce <= 1.69.... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94173 Contributor Insecure Direct Object References (IDOR) in Business Directory <= 6.... |
medium | 5.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94077 Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions. |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94074 Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-62078 Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.1... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-62079 Contributor Cross Site Scripting (XSS) in Qi Addons For Elementor <= 1.11 versio... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-62080 Contributor Cross Site Scripting (XSS) in Happy Addons for Elementor <= 3.23.1 v... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-62081 Contributor Insecure Direct Object References (IDOR) in Flexible PDF Coupons <=... |
medium | 5.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-62083 Subscriber Other Vulnerability Type in Creator LMS <= 1.2.19 versions. |
medium | 5.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-18417 The native BSD-socket layer recorded a pending asynchronous socket error by type... |
medium | 6.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-18746 parse_write_op() in subsys/net/lib/lwm2m/lwm2m_message_handling.c handles inboun... |
medium | 5.9 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-18747 The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit pac... |
medium | 6.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-103114 A vulnerability was identified in OS4ED openSIS-Classic up to 9.3. |
medium | 6.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103117 A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. |
medium | 4.7 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102912 A vulnerability was identified in SourceCodester Online Leave Management System... |
medium | 4.7 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102842 A vulnerability was identified in gedelumbung HospitalManagement up to c2d455437... |
medium | 6.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102845 A security vulnerability has been detected in gedelumbung HospitalManagement up... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102386 Subscriber Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.003 versi... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102399 Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic... |
medium | 5.4 | — | — | 2026-09-30 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.