September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-96897 The Optima Express IDX WordPress plugin before 8.7.6 does not perform any author... |
medium | 5.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-96899 The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralis... |
medium | 6.8 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-97227 The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does... |
medium | 5.9 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-97319 The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.2 does... |
medium | 6.8 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-85738 TREK is a collaborative travel planner. |
medium | 6.3 | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-54790 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
medium | 6.0 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-59563 Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation... |
medium | 4.6 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101069 A weakness has been identified in dbgate up to 7.3.1. |
medium | 6.5 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100712 froxlor through 2.3.10 disables a user's two-factor authentication immediately u... |
medium | 6.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-96531 The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attribu... |
medium | 6.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-96533 The Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-... |
medium | 5.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-97864 A vulnerability has been found in GibbonEdu Gibbon up to 30.0.01. |
medium | 5.3 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-97866 A weakness has been identified in Zhonglun CloudPOS 3.0. |
medium | 5.6 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-97879 A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. |
medium | 5.3 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-97884 A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5d... |
medium | 6.3 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-97895 A vulnerability was determined in krayin laravel-crm up to 2.2.5. |
medium | 6.3 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-15273 The Automatic.css plugin for WordPress is vulnerable to Stored Cross-Site Script... |
medium | 6.4 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100877 A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project up to... |
medium | 4.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100878 A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. |
medium | 6.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100883 A flaw has been found in Krayin laravel-crm up to 2.2.5. |
medium | 6.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100884 A vulnerability has been found in Krayin laravel-crm up to 2.2.5. |
medium | 4.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100887 A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Manage... |
medium | 6.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100892 A vulnerability was found in aligungr UERANSIM up to 3.3.0. |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100895 A security flaw has been discovered in Trusted Domain Project OpenARC up to 1.0.... |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100898 A vulnerability was detected in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3... |
medium | 6.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100899 A flaw has been found in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/... |
medium | 6.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100906 A vulnerability was detected in Eyeplus 57.0.0.0308. |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101004 A security vulnerability has been detected in notionnext-org NotionNext up to 4.... |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101010 A vulnerability was identified in aaPanel BaoTa up to 11.8.0. |
medium | 4.7 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101011 A security flaw has been discovered in aaPanel BaoTa up to 11.8.0. |
medium | 4.7 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101035 A flaw has been found in aligungr UERANSIM up to 3.3.0. |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101036 A vulnerability has been found in FLB-Music FLB-Music-Player 1.1.8/1.1.9/1.2.0/1... |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101055 A security flaw has been discovered in Thinkware U3000 up to 1.02.04. |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100890 A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101016 A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2. |
medium | 6.5 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101017 A vulnerability was found in Trusted Domain Project OpenDMARC up to 1.4.2. |
medium | 6.5 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-97869 A flaw has been found in langchain4j up to 1.5.3-beta10/1.11.10-beta18/1.18.1-be... |
medium | 4.1 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-85274 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
medium | 6.5 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-85289 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
medium | 6.5 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-85291 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
medium | 6.5 | — | — | 2026-09-25 | 2026-09-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.