September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,291
Critical
1,223
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-78451 Untrusted pointer dereference in Microsoft Windows SCSI Class System File allows... |
medium | 6.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-11 |
| CVE-2026-78452 Out-of-bounds read in Microsoft Windows SCSI Class System File allows an unautho... |
medium | 4.6 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-11 |
| CVE-2026-78454 Out-of-bounds read in Windows CD-ROM Driver allows an authorized attacker to dis... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-86080 n8n is an open source workflow automation platform. |
medium | 5.3 | — | N8n / n8n | 2026-09-08 | 2026-09-11 |
| CVE-2026-86079 n8n is an open source workflow automation platform. |
medium | 6.5 | — | N8n / n8n | 2026-09-08 | 2026-09-11 |
| CVE-2026-86078 n8n is an open source workflow automation platform. |
medium | 6.5 | — | N8n / n8n | 2026-09-08 | 2026-09-11 |
| CVE-2026-15439 The GamiPress plugin for WordPress is vulnerable to authenticated (Subscriber+)... |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-14562 The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not perform a... |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-14565 The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform... |
medium | 5.4 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-14566 The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform... |
medium | 4.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-82305 The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify tha... |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-83545 The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom sk... |
medium | 6.8 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-83546 The CoolClock WordPress plugin before 4.3.8 does not properly escape a skin sett... |
medium | 6.8 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-85678 The AI Builder WordPress plugin before 2.7.8 does not sanitise custom JavaScript... |
medium | 6.8 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-86780 The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and... |
medium | 6.8 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-86781 The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin befor... |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-86782 The Visualizer WordPress plugin before 4.0.6 does not properly authorise access... |
medium | 5.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-86812 The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to... |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-86815 The BackWPup WordPress plugin before 5.7.5 does not properly restrict access to... |
medium | 5.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-82213 The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that th... |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-82215 The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 do... |
medium | 5.9 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-85116 The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin from 1.2.2 before... |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-86809 The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify... |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-86813 The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline c... |
medium | 4.8 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89264 MoguBlog through 6.2 fails to validate the comment author identity in the POST /... |
medium | 4.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89173 Smart Video Intercom System developed by Kingdom Communication Associated has a... |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-84960 The WP-Members Membership Plugin plugin for WordPress is vulnerable to Reflected... |
medium | 6.1 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-77150 The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Refle... |
medium | 6.1 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-11446 The Booktics – Booking Calendar for Appointments and Service Businesses plugin f... |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-84890 undici's decompress interceptor decompresses response bodies according to the un... |
medium | 5.9 | — | Nodejs / undici | 2026-09-04 | 2026-09-11 |
| CVE-2026-57166 PJSIP is a free and open source multimedia communication library written in C. |
medium | 5.3 | — | Teluu / pjsip | 2026-09-04 | 2026-09-11 |
| CVE-2026-57165 PJSIP is a free and open source multimedia communication library written in C. |
medium | 5.3 | — | Teluu / pjsip | 2026-09-04 | 2026-09-11 |
| CVE-2026-89179 WeenyGenius, a computer lab management system by Howyar Technologies, has a Miss... |
medium | 4.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89175 Smart Video Intercom System developed by Kingdom Communication Associated has a... |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-18562 The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is... |
medium | 6.1 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-57164 PJSIP is a free and open source multimedia communication library written in C. |
medium | 5.9 | — | Teluu / pjsip | 2026-09-04 | 2026-09-11 |
| CVE-2026-57160 PJSIP is a free and open source multimedia communication library written in C. |
medium | 5.3 | — | Teluu / pjsip | 2026-09-04 | 2026-09-11 |
| CVE-2026-89148 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an open... |
medium | 5.4 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89240 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a r... |
medium | 6.1 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89245 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a c... |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-11 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.