September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84069 The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of it... |
medium | 5.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-85002 The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block at... |
medium | 6.8 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-86841 The Online Scheduling and Appointment Booking System WordPress plugin before 28.... |
medium | 4.7 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-89000 The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a... |
medium | 4.1 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-89001 The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not verify th... |
medium | 4.9 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-89003 The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a... |
medium | 4.1 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-89006 The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize... |
medium | 6.8 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-92436 The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authe... |
medium | 5.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-92995 The Verge3D Publishing and E-Commerce WordPress plugin through 4.13.0 does not r... |
medium | 5.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-84744 The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcod... |
medium | 6.5 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-86838 The Bookly WordPress plugin before 28.3 does not validate client-supplied bookin... |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-88828 The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does... |
medium | 5.4 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-89300 The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation... |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-89303 The Post Voting System WordPress plugin through 1.0 does not properly sanitize a... |
medium | 6.4 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-89411 The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a... |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-92996 The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the... |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-93000 The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query... |
medium | 6.8 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100237 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-63432 Horilla is an HR and CRM software. |
medium | 6.5 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-72662 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to... |
medium | 6.3 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-78582 Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of d... |
medium | 6.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-18311 Readwise Reader for Android contains a cross-site scripting vulnerability due to... |
medium | 6.1 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-18312 Readwise Reader for Android constructs URLs in its WebView using attacker-contro... |
medium | 6.1 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-18320 Readwise Reader for Android uses a sanitize-html configuration that permits all... |
medium | 6.1 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-80359 Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contai... |
medium | 6.8 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-94387 Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in... |
medium | 5.4 | — | — | 2026-09-21 | 2026-09-28 |
| CVE-2026-91119 Discourse is an open-source discussion platform. |
medium | 6.4 | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-79760 Termix is a web-based server management platform with SSH terminal, tunneling, a... |
medium | 6.4 | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-79762 Termix is a web-based server management platform with SSH terminal, tunneling, a... |
medium | 5.5 | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-100745 A vulnerability has been found in Edimax BR-6428nC 1.16. |
medium | 6.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100836 Contrast through 1.20.0 contains a panic vulnerability in the transit-engine end... |
medium | 4.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-101071 A vulnerability was determined in Acrel Electric Unet Web Service up to 20260814... |
medium | 6.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-21098 Improper access control in Link to Windows prior to SMR Sep-2026 Release 1 allow... |
medium | 6.1 | — | Samsung / android | 2026-09-09 | 2026-09-28 |
| CVE-2026-92874 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3... |
medium | 5.4 | — | Gitlab / gitlab | 2026-09-24 | 2026-09-28 |
| CVE-2026-19619 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0... |
medium | 4.7 | — | Gitlab / gitlab | 2026-09-16 | 2026-09-28 |
| CVE-2026-16794 GitLab has remediated an issue in GitLab EE affecting all versions from 18.11 be... |
medium | 4.3 | — | Gitlab / gitlab | 2026-09-16 | 2026-09-28 |
| CVE-2024-11222 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0... |
medium | 6.4 | — | Gitlab / gitlab | 2026-09-16 | 2026-09-28 |
| CVE-2026-83459 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: hel... |
medium | 5.3 | — | Oracle / helidon | 2026-09-15 | 2026-09-28 |
| CVE-2026-83458 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: JSO... |
medium | 5.3 | — | Oracle / helidon | 2026-09-15 | 2026-09-28 |
| CVE-2026-96895 The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attribut... |
medium | 6.8 | — | — | 2026-09-27 | 2026-09-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.