September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-93534 A vulnerability was identified in spatie Scotty up to 1.4.2. |
medium | 6.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-3096 The product's web portals allow external links to be opened in a new browser tab... |
medium | 4.7 | — | — | 2026-09-10 | 2026-09-18 |
| CVE-2026-4103 Insufficient HTML sanitization in the Publisher Portal and Developer Portal allo... |
medium | 6.4 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2025-5802 The self-registration flow accepts user-supplied input for usernames without ade... |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-81903 Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submit... |
medium | 5.4 | — | Concretecms / concrete cms | 2026-09-14 | 2026-09-18 |
| CVE-2026-14986 The ITE it51xxx I2C driver, when operating as an I2C target (slave) in buffer mo... |
medium | 6.8 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-16514 gptp_mi_qualify_announce() in subsys/net/l2/ethernet/gptp/gptp_mi.c walks the Pa... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-16515 net_icmpv6_send_error() in subsys/net/ip/icmpv6.c implemented only one of the th... |
medium | 4.7 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-19504 Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability. |
medium | 4.0 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-86788 The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict... |
medium | 6.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-86824 The Newsletter WordPress plugin before 9.3.8 does not generate its email trackin... |
medium | 4.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-90922 The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-90923 The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one... |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-91009 The Active Woot Products Tables for WooCommerce. |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-91010 The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPres... |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-91011 The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape... |
medium | 6.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-91015 The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform a... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-91016 The Motors WordPress plugin before 1.4.121 does not verify that a request is aut... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-91019 The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not... |
medium | 4.9 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-87829 The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin b... |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-87831 The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin b... |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-84902 The King Addons for Elementor WordPress plugin before 51.1.81 does not perform a... |
medium | 6.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-85009 The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-85123 The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not vali... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-85350 The UpsellWP WordPress plugin before 2.2.10 does not check that products added t... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-87965 The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessabl... |
medium | 4.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-87966 The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an owners... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-88798 The Really Simple Security WordPress plugin before 9.8.3 does not validate a cli... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-88993 The All Bootstrap Blocks WordPress plugin through 1.3.31 does not properly escap... |
medium | 6.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-90984 The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not res... |
medium | 5.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-79713 The Breeze Cache WordPress plugin before 2.5.15 does not include a set of tracki... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-86796 The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a reque... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-86800 The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-88994 The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a blo... |
medium | 6.6 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-90976 The Clean Login WordPress plugin before 1.19 does not check whether user registr... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-90977 The Clean Login WordPress plugin before 1.19 does not verify its registration CA... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-25684 A file type attribution issue in Zscaler Internet Access File Type Control evalu... |
medium | 4.4 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-90982 @fastify/static is a Fastify plugin that serves static files from a configured r... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-13623 An improper neutralization of input during web page generation ('Cross-site Scri... |
medium | 4.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-40533 An exposure of sensitive information through data queries vulnerability in Deskt... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.