September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84046 The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPr... |
medium | 5.0 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-84098 The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPr... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-84150 The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPr... |
medium | 5.4 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-84168 The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidde... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-84741 The Events Calendar WordPress plugin before 6.17.5 does not check the post statu... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-85006 The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an... |
medium | 6.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-86602 The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capabili... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-86603 The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisati... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-86783 The Post Grid Gutenberg Blocks WordPress plugin before 5.0.41 does not perform a... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-86842 The Real3D Flipbook WordPress plugin before 5.4 does not perform capability chec... |
medium | 6.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-86601 The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes fr... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-86604 The GTranslate WordPress plugin before 5.0.1 does not remove shortcodes from the... |
medium | 4.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-86612 The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expa... |
medium | 5.6 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-87070 The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a req... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-87071 The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which me... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-87978 The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the re... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-78574 The Okta Hyperdrive Integration plugin resolves a required assembly using a regi... |
medium | 6.3 | — | Okta / hyperdrive | 2026-09-08 | 2026-09-23 |
| CVE-2026-86785 The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-87979 The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the re... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-87981 The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a cap... |
medium | 4.7 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-88929 The Product Badge, Label, Countdown Timer for WooCommerce WordPress plugin befor... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-88997 The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escap... |
medium | 6.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-89331 The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the me... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-90985 The WPC Smart Compare for WooCommerce WordPress plugin before 6.6.1 does not app... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-91024 The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape... |
medium | 6.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-91025 The Booking Manager WordPress plugin before 2.1.21 does not verify that a reques... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-91073 The Subscribe Forms WordPress plugin before 1.6.3 does not sanitise and escape o... |
medium | 6.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93510 The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not v... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93511 The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webh... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-90950 The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-64684 RMCP is an official Rust SDK for the Model Context Protocol. |
medium | 6.8 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-75523 Steeltoe is an open source project that provides a collection of libraries that... |
medium | 5.9 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-85999 Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-54521 FairEmail is a fully featured, open source, privacy-friendly email app for Andro... |
medium | 6.1 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-54907 Caddy Proxy Manager is a web interface for managing Caddy Server reverse proxies... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-54644 CubeCart is an ecommerce software solution. |
medium | 6.1 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-77607 Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-69186 c-ares is an asynchronous resolver library. |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-77385 Kyoo is a self-hosted media server focused on movies, series, and anime. |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-77399 icalendar is an RFC 5545 compatible parser and generator of iCalendar files for... |
medium | 6.5 | — | — | 2026-09-22 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.