September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,291
Critical
1,223
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84023 The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce or check use... |
medium | 6.5 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-84024 The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce before savin... |
medium | 4.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-86790 The WP Highlight Box WordPress plugin through 1.0 does not escape some shortcode... |
medium | 6.8 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-87797 The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capabilit... |
medium | 4.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-87891 The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any c... |
medium | 6.5 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-87892 The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the or... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-87894 The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any a... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-87916 The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-87918 The WPBot WordPress plugin before 8.5.7 does not perform any authorization or no... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-87919 The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does... |
medium | 4.9 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-77773 The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2... |
medium | 5.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-80072 The User Registration & Membership WordPress plugin before 5.2.8 does not valida... |
medium | 4.7 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-88764 The Simple Membership WordPress plugin before 4.7.8 does not validate that the m... |
medium | 5.4 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-88912 The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12... |
medium | 4.2 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-88995 The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does... |
medium | 5.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-89050 The Quads Ads Manager for Google AdSense WordPress plugin before 3.0.5 does not... |
medium | 4.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-75134 SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scri... |
medium | 6.4 | — | — | 2026-09-02 | 2026-09-14 |
| CVE-2026-90538 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a m... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-90539 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a m... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-90540 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to val... |
medium | 4.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-90543 WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier, with... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-90544 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to val... |
medium | 4.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-90545 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to val... |
medium | 4.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-90548 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to val... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-90549 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to pro... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-90550 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to che... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-68570 Incorrect Authorization vulnerability in Apache Doris allows an authenticated us... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-75015 Insufficiently Protected Credentials vulnerability in Apache Syncope. |
medium | 4.9 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-77147 Improper Control of Generation of Code ('Code Injection') vulnerability in Apach... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-77883 Exposure of sensitive information through data queries vulnerability in Apache S... |
medium | 4.9 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-78318 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-73191 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Sync... |
medium | 6.1 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-84179 Description
getTopologyPageInfo merged the Nimbus daemon configuration with the... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-82426 Description
Nimbus accepted the `uploadedJarLocation` argument of `submitTopolo... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-82433 Description
`getNimbusConf` returned the complete daemon configuration without... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-82434 Description
When ZooKeeper authentication is configured, Storm deliberately ret... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-82437 Description
The Logviewer offers `logs.users` and `logs.groups` so operators ca... |
medium | 4.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90485 A flaw has been found in IOBit Uninstaller 15.5.0.11. |
medium | 5.5 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-90487 A vulnerability was found in Xuxueli xxl-job up to 3.4.2. |
medium | 4.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-90490 A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.