September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,291
Critical
1,223
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-6642 The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-S... |
medium | 6.4 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-62140 Unauthenticated Insecure Direct Object References (IDOR) in Quiz And Survey Mast... |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-62110 Contributor Cross Site Scripting (XSS) in Bold Page Builder <= 5.9.9 versions. |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-62113 Contributor Insecure Direct Object References (IDOR) in Slim SEO <= 4.10.0 versi... |
medium | 4.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-62114 Unauthenticated Broken Access Control in Passster <= 4.3.13 versions. |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-62132 Subscriber Broken Access Control in Masteriyo - LMS <= 3.4.0 versions. |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-62135 Unauthenticated Broken Access Control in Booktics <= 1.0.24 versions. |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-62136 Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price C... |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-62137 Unauthenticated Sensitive Data Exposure in bbPress <= 2.6.14 versions. |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-62088 Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticP... |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-19946 The Awesome Support plugin for WordPress is vulnerable to Missing Authorization... |
medium | 4.3 | — | — | 2026-09-09 | 2026-09-11 |
| CVE-2026-19797 The User Access Manager plugin for WordPress is vulnerable to Reflected Cross-Si... |
medium | 6.1 | — | — | 2026-09-09 | 2026-09-11 |
| CVE-2026-15823 The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized... |
medium | 4.3 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-11496 The Woo PDF Invoice Builder plugin (also distributed as "PDF Builder for WooComm... |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-27378 Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCo... |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-62111 Contributor Cross Site Scripting (XSS) in Simple Payment <= 2.5.4 versions. |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-62133 Subscriber Cross Site Request Forgery (CSRF) in RTMKit <= 2.1.5 versions. |
medium | 5.4 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-62134 Contributor Insecure Direct Object References (IDOR) in Starter Templates <= 4.7... |
medium | 4.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-62138 Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.... |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-62139 Unauthenticated Cross Site Request Forgery (CSRF) in Site Kit by Google <= 1.186... |
medium | 4.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-84651 In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endp... |
medium | 6.3 | — | Jenkins / jenkins | 2026-09-02 | 2026-09-11 |
| CVE-2026-84646 In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear a... |
medium | 4.3 | — | Jenkins / jenkins | 2026-09-02 | 2026-09-11 |
| CVE-2026-81377 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
medium | 6.5 | — | Microsoft / visual studio code | 2026-09-08 | 2026-09-11 |
| CVE-2026-73310 XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoin... |
medium | 5.9 | — | Xenforo / xenforo | 2026-09-08 | 2026-09-11 |
| CVE-2026-73321 XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BB... |
medium | 6.5 | — | Xenforo / xenforo | 2026-09-08 | 2026-09-11 |
| CVE-2026-73320 XenForo before 2.3.13 contains an unauthenticated information disclosure vulnera... |
medium | 6.1 | — | Xenforo / xenforo | 2026-09-08 | 2026-09-11 |
| CVE-2026-73319 XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynam... |
medium | 6.1 | — | Xenforo / xenforo | 2026-09-08 | 2026-09-11 |
| CVE-2026-8304 Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Rese... |
medium | 5.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-9160 Improper neutralization of special elements used in a template engine vulnerabil... |
medium | 4.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89241 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a r... |
medium | 6.1 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89261 MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mog... |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-88938 knowns through 0.33.0 fails to confine the path argument of the code.find MCP to... |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-11 |
| CVE-2026-89090 An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go... |
medium | 5.9 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-78455 Out-of-bounds read in Xbox allows an unauthorized attacker to disclose informati... |
medium | 4.3 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-87468 Incorrect authorization in Isolated in Google Chrome prior to 153.0.8010.36 allo... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-87493 Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allo... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-87519 Incorrect authorization in Safebrowsing in Google Chrome prior to 153.0.8010.36... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-87522 Missing authorization in WebView in Google Chrome on on Android prior to 153.0.8... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-89246 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a C... |
medium | 5.4 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89251 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate... |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-11 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.