September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-95600 Unauthenticated Sensitive Data Exposure in TrustedLogin Connector <= 2.0.3 versi... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94457 Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions. |
medium | 4.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94498 Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions. |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94671 Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions. |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94682 Contributor Cross Site Scripting (XSS) in Podcast Importer SecondLine <= 1.5.6 v... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95524 Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions. |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95530 Subscriber Cross Site Scripting (XSS) in PixelYourSite – Your smart PIXEL (TAG)... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93709 Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivale... |
medium | 5.3 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-93772 Subscriber Cross Site Scripting (XSS) in wpForo Forum <= 3.1.5 versions. |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94118 Contributor Cross Site Scripting (XSS) in Premium Blocks – Gutenberg Blocks for... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94168 Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.1... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93513 Contributor Insecure Direct Object References (IDOR) in SiteSkite <= 2.1.7 versi... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93529 Contributor Broken Access Control in WSP MCP – AI Agents Connector <= 2.7.0 vers... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93620 Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versio... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-12751 IBM Cloud Pak for Business Automation is vulnerable to HTML injection. |
medium | 5.4 | — | Ibm / cloud pak for business automation | 2026-09-15 | 2026-09-23 |
| CVE-2026-12750 IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripti... |
medium | 5.4 | — | Ibm / cloud pak for business automation | 2026-09-15 | 2026-09-23 |
| CVE-2026-12749 IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripti... |
medium | 5.4 | — | Ibm / cloud pak for business automation | 2026-09-15 | 2026-09-23 |
| CVE-2026-78227 NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulne... |
medium | 6.5 | — | Nlnetlabs / unbound | 2026-09-16 | 2026-09-23 |
| CVE-2026-91963 FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure v... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-23 |
| CVE-2026-91962 FreeRDP before 3.31.0 contains an integer overflow in the audin Apple backends w... |
medium | 6.3 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-23 |
| CVE-2026-91961 FreeRDP before 3.31.0 contains a denial-of-service vulnerability in the URBDRC c... |
medium | 6.5 | — | Freerdp / freerdp | 2026-09-15 | 2026-09-23 |
| CVE-2026-81380 Improper neutralization of special elements used in a command ('command injectio... |
medium | 5.9 | — | Microsoft / visual studio code | 2026-09-08 | 2026-09-23 |
| CVE-2026-82720 NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulner... |
medium | 5.9 | — | Nlnetlabs / unbound | 2026-09-16 | 2026-09-23 |
| CVE-2026-54643 CubeCart is an ecommerce software solution. |
medium | 5.4 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-54648 CubeCart is an ecommerce software solution. |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-88020 Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input d... |
medium | 6.1 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-95625 The Tauri updater plugin verifies update binaries using minisign signatures, but... |
medium | 5.9 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-96456 The Reachy Mini Bluetooth service asks a connecting device for a PIN before it w... |
medium | 6.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-6669 Missing upper bound on the key derivation iteration count accepted during SCRAM... |
medium | 5.9 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93618 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93623 Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 v... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94079 Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions. |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94080 Unauthenticated Broken Access Control in MarketKing <= 2.1.70 versions. |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94391 Contributor Cross Site Scripting (XSS) in Ultimate FAQ <= 2.4.14 versions. |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94461 Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions. |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94500 Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94679 Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions. |
medium | 5.4 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-94680 Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions. |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95514 Unauthenticated Bypass Vulnerability in Netgsm <= 2.10.0 versions. |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95523 Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions. |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.