September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-95525 Subscriber Arbitrary File Deletion in WP User Frontend <= 4.3.11 versions. |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95527 Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versio... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95586 Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <=... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95602 Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooC... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-96548 A flaw has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65... |
medium | 5.6 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-92764 OpenCVE versions 2.4.0 before 3.1.0 fails to properly scope the organizations AP... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-91092 The wpForo Forum plugin for WordPress is vulnerable to authorization bypass in a... |
medium | 4.3 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-18439 The Tutor LMS – eLearning and online course solution plugin for WordPress is vul... |
medium | 4.3 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-15915 IBM Concert 1.0.0 through 3.0.0 could allow a local attacker to obtain sensitive... |
medium | 6.2 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-84618 A permissions issue was addressed with improved validation. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-23 |
| CVE-2026-84619 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 6.1 | — | Apple / macos | 2026-09-14 | 2026-09-23 |
| CVE-2026-84621 An authorization issue was addressed with improved access control. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-23 |
| CVE-2026-84624 A permissions issue was addressed with improved path validation. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-23 |
| CVE-2026-84628 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | Apple / ipados | 2026-09-14 | 2026-09-23 |
| CVE-2026-61745 InvenTree is an Open Source Inventory Management System. |
medium | 4.3 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-61746 InvenTree is an Open Source Inventory Management System. |
medium | 5.3 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-61747 InvenTree is an Open Source Inventory Management System. |
medium | 4.3 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-55179 Joplin is an open source note-taking and to-do application that organises notes... |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-59816 Joplin is an open source note-taking and to-do application that organises notes... |
medium | 4.3 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-61722 FluidSynth is a software synthesizer based on the SoundFont 2 specifications. |
medium | 6.8 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-76805 Nuclei is a vulnerability scanner built on a simple YAML-based DSL. |
medium | 5.3 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-83600 Netdata is an open source observability tool. |
medium | 6.5 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-86056 Notepad++ is a free and open-source source code editor. |
medium | 5.5 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-63334 draw.io is a configurable diagramming and whiteboarding application. |
medium | 6.8 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-63373 draw.io is a configurable diagramming and whiteboarding application. |
medium | 4.2 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-93307 A vulnerability has been found in O-RAN-SC SMO OAM 2025-06-10. |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-78579 The Okta Access Gateway does not sanitize SAML assertion attribute values before... |
medium | 6.5 | — | Okta / access gateway | 2026-09-08 | 2026-09-23 |
| CVE-2026-16426 IBM Concert 1.0.0 through 3.0.0 is vulnerable to server-side request forgery (SS... |
medium | 6.5 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-17465 IBM Concert 1.0.0 through 3.0.0 could allow a remote authenticated attacker to c... |
medium | 6.5 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-16264 The Newsletters WordPress plugin before 4.18.1 does not perform an ownership che... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-18364 The zportals WordPress plugin before 6.4.2 does not perform any capability or no... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-18365 The zportals WordPress plugin before 6.4.2 does not perform any capability or no... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-77765 The Better Payment WordPress plugin before 2.3.4 does not validate the submitted... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-77766 The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPr... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-80342 The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.27 does n... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-81338 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not pro... |
medium | 4.6 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-81339 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not per... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-83555 The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not veri... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-84026 The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPr... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-84027 The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPr... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.