September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-90541 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to req... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-19 |
| CVE-2026-92249 The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cros... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-86726 AVideo through 29.0 contains an information disclosure vulnerability in restream... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-19 |
| CVE-2026-86731 Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard i... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-19 |
| CVE-2026-78296 Insufficient Verification of Data Authenticity vulnerability in WP ManageNinja L... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-78294 Contributor Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions. |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-81305 CM2507 IP cameras automatically execute a predetermined script from removable me... |
medium | 6.8 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-76755 Vulnerability in Drupal Gammu SMS Daemon. |
medium | 5.9 | — | — | 2026-09-02 | 2026-09-19 |
| CVE-2026-76756 Vulnerability in Drupal Gammu SMS Daemon. |
medium | 5.9 | — | — | 2026-09-02 | 2026-09-19 |
| CVE-2026-66572 Contributor Cross Site Scripting (XSS) in JetBlog <= 2.4.10 versions. |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-66577 Contributor Cross Site Scripting (XSS) in JetSearch <= 3.6.3 versions. |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-66617 Contributor Cross Site Scripting (XSS) in PublishPress Series <= 3.1.3 versions. |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-73999 Contributor Insecure Direct Object References (IDOR) in Cooked <= 1.16.0 version... |
medium | 5.4 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-75961 The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vuln... |
medium | 4.9 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-20072 A vulnerability in the web-based management interface of Cisco ISE could allow a... |
medium | 4.9 | — | — | 2026-09-16 | 2026-09-19 |
| CVE-2026-2585 The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site... |
medium | 6.4 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-1025 IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-1030 IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-1031 IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-18441 The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-15004 The FileBird – WordPress Media Library Folders & File Manager plugin for WordPre... |
medium | 5.4 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-15797 The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimat... |
medium | 6.4 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-12739 The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPr... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-11537 IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to o... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-92933 vm2 is a sandbox for running untrusted Node.js code. |
medium | 5.8 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-74002 Unauthenticated Broken Access Control in Booking Calendar <= 11.7 versions. |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-78528 Unauthenticated Broken Access Control in BerqWP <= 4.1.15 versions. |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-27553 A low-privileged remote attacker can manipulate the schema path parameter in the... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-19 |
| CVE-2026-66574 Contributor Cross Site Scripting (XSS) in Element Pack Elementor Addons <= 8.8.3... |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-66579 Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.2.1 v... |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-92963 vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-93310 A vulnerability was identified in O-RAN-SC SMO OAM 2025-06-10. |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-85652 The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-92622 The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site... |
medium | 6.4 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-82980 Any authenticated user can lock or unlock files they do not own by targeting abs... |
medium | 6.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-82982 The Approval app's approve/reject endpoint is meant to require the file's curren... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-82985 The Photos app's filter-based "smart albums" build their file listing using the... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-77164 Circles' remote-instance signature verification fetches the attacker-supplied ke... |
medium | 6.2 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-77169 A vulnerability in the team folders (formerly group folders) app when used in co... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-77170 The Deck config API allows authenticated users to set board-scoped configuration... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.