September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,291
Critical
1,223
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-11821 The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)... |
medium | 5.4 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-11363 The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPr... |
medium | 6.6 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-69636 Improper neutralization of special elements used in an sql command ('sql injecti... |
medium | 6.5 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-09 |
| CVE-2026-87477 Information leak in Core in Google Chrome prior to 153.0.8010.36 allowed a remot... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87478 Observable discrepancy in Autofill in Google Chrome prior to 153.0.8010.36 allow... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87459 Observable discrepancy in Select in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87454 Information leak in Enterprise in Google Chrome on on Windows prior to 153.0.801... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87453 Confused deputy in BackgroundFetch in Google Chrome prior to 153.0.8010.36 allow... |
medium | 5.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87443 Missing authorization in Actor in Google Chrome prior to 153.0.8010.36 allowed a... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87439 Information leak in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowe... |
medium | 5.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87437 Information leak in Frames in Google Chrome prior to 153.0.8010.36 allowed a rem... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87435 Information leak in ControlledFrame in Google Chrome prior to 153.0.8010.36 allo... |
medium | 5.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87083 A weakness has been identified in tile-ai tilelang up to 0.1.14. |
medium | 5.5 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-85037 The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a cli... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-85132 The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or... |
medium | 4.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-85133 The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or... |
medium | 5.4 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-85418 The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fo... |
medium | 5.4 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-85117 The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode pars... |
medium | 6.5 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-83541 The Sina Extension for Elementor WordPress plugin before 3.10.4 does not properl... |
medium | 6.8 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-84113 The Quentn WP WordPress plugin before 1.2.15 does not properly sanitise and esca... |
medium | 4.1 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-84222 The Kirki WordPress plugin before 6.3.0 does not check whether the requester is... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-83537 The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-sid... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-82184 The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have any authoris... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-82185 The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability o... |
medium | 4.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-82848 The Masteriyo LMS WordPress plugin before 3.4.0 does not perform any authorizati... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-81022 The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-81741 The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin bef... |
medium | 4.7 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-80339 The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does n... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-80340 The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does n... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-80341 The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does n... |
medium | 5.9 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-81021 The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-80440 The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submi... |
medium | 4.8 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-78742 Silverpeas Core <=6.4.6 is vulnerable to Cross Site Scripting (XSS) via the Mult... |
medium | 6.1 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-75861 The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not... |
medium | 6.5 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-75905 The WP Recipe Maker plugin for WordPress is vulnerable to authorization bypass i... |
medium | 4.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-74859 The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives wi... |
medium | 6.8 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-55512 nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-58113 A vulnerability has been identified in Teamcenter V2412 (All versions < V2412.00... |
medium | 6.1 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-19800 The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emai... |
medium | 4.9 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-19802 The Checkout Custom Fields Builder for WooCommerce plugin for WordPress is vulne... |
medium | 4.3 | — | — | 2026-09-09 | 2026-09-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.