September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-75959 The GoPay for WooCommerce plugin for WordPress is vulnerable to generic SQL Inje... |
medium | 4.9 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-7527 The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vu... |
medium | 4.7 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-87917 The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflect... |
medium | 6.1 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-9232 The Easy Appointments plugin for WordPress is vulnerable to Sensitive Informatio... |
medium | 6.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-9615 The Flex Import plugin for WordPress is vulnerable to Missing Authorization in a... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-9832 The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable... |
medium | 5.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-9855 The Custom Field Template plugin for WordPress is vulnerable to generic SQL Inje... |
medium | 6.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-18346 The TikTok plugin for WordPress is vulnerable to authorization bypass in all ver... |
medium | 5.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-1256 The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and St... |
medium | 6.4 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-5410 The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 6.4 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-76579 The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site S... |
medium | 4.7 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-8354 The Gum Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-S... |
medium | 6.4 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-9289 The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sen... |
medium | 5.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-9613 The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress is vulnerabl... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-9766 The Empik for Woocommerce plugin for WordPress is vulnerable to authorization by... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-9858 The Partial Shipment for Woocommerce plugin for WordPress is vulnerable to Missi... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-94049 A flaw has been found in 06ketan slideshot up to 4.4.0. |
medium | 4.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94091 A weakness has been identified in piskvorky gensim up to 4.4.0. |
medium | 5.5 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94149 A vulnerability was identified in Omega Solution HRM OS up to 20260717. |
medium | 4.3 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-87248 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
medium | 6.7 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-93376 Out of bounds read in DataTransfer in Google Chrome prior to 153.0.8010.52 allow... |
medium | 6.3 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-91966 AVideo through 29.0 contains an unauthenticated server-side request forgery vuln... |
medium | 5.8 | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-90971 Server-Side Request Forgery (SSRF) in the VMware synchronization feature in Devo... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-90520 A vulnerability has been found in jaychouchannel Tourism-Management-System up to... |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-20 |
| CVE-2026-90525 A weakness has been identified in itsourcecode Sales and Inventory System 1.0. |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-20 |
| CVE-2026-90969 Improper access control in the vault entry listing feature in Devolutions Server... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-86764 Snipe-IT through 8.6.4 (fixed in 8.7.0) does not enforce the components.view per... |
medium | 6.5 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-20 |
| CVE-2026-86769 Snipe-IT versions before 8.7.0 contain an improper ownership management vulnerab... |
medium | 4.3 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-20 |
| CVE-2026-86774 Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in... |
medium | 6.3 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-20 |
| CVE-2026-88922 The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privileg... |
medium | 6.7 | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-82519 Really Simple Security plugin for WordPress before 9.8.2 contains a missing auth... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-20 |
| CVE-2026-84850 Improper certificate validation in the shared HTTP client used by synchronizatio... |
medium | 4.8 | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-65382 A parsing issue in the handling of directory paths was addressed with improved p... |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-20 |
| CVE-2026-13272 IBM Verify Identity Access is missing origin validation which could allow a remo... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-20 |
| CVE-2026-11918 IBM ContextForge MCP Gateway <= v1.0.4 IBM mcp-context-forge could allow an auth... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-11927 IBM Security Verify Identity Access reverse proxy may allow parameters to be inj... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-76757 Vulnerability in Drupal Gammu SMS Daemon. |
medium | 5.9 | — | — | 2026-09-02 | 2026-09-19 |
| CVE-2026-92554 The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-86736 snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkou... |
medium | 4.3 | — | Snipeitapp / snipe-it | 2026-09-08 | 2026-09-19 |
| CVE-2026-86749 Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not check the return value of sto... |
medium | 6.3 | — | Snipeitapp / snipe-it | 2026-09-09 | 2026-09-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.