September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,291
Critical
1,223
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-15247 The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or... |
medium | 5.4 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-19861 The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2... |
medium | 4.7 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-78149 The Smart Post WordPress plugin before 4.0.8 does not check whether a post is pa... |
medium | 5.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-81423 The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a use... |
medium | 4.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-81424 The Accept Stripe Payments WordPress plugin before 2.1.4 does not verify that th... |
medium | 5.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-82846 The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape som... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-83543 The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied... |
medium | 4.1 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-83544 The Greenshift WordPress plugin before 13.2.0 does not properly escape a block a... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84021 The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84022 The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84221 The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifi... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84896 The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84898 The Eventin WordPress plugin before 4.1.21 does not properly validate a template... |
medium | 6.6 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84899 The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84901 The Eventin WordPress plugin before 4.1.22 does not properly check authorization... |
medium | 4.9 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-13159 The Real Estate Papi WordPress theme through 1.0.5 does not perform capability o... |
medium | 4.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-75793 The SureCart WordPress plugin before 4.7.0 does not consult the site's user regi... |
medium | 6.5 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-84028 The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape... |
medium | 6.8 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-19859 The JetFormBuilder WordPress plugin before 3.6.5.2 does not sanitize a request p... |
medium | 6.5 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-19862 The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip li... |
medium | 4.8 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-80437 The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent sho... |
medium | 4.8 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-80439 The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 doe... |
medium | 4.8 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-84185 A flaw was found in the jwcrypto library, which is used for implementing Javascr... |
medium | 5.9 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-85534 A flaw was found in libsoup. |
medium | 5.9 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85769 A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-76925 A flaw was found in Flatpak. |
medium | 5.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-86469 A flaw was found in GLib2. |
medium | 5.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-62654 A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). |
medium | 6.8 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-20510 In camera middleware, there is a possible escalation of privilege due to double... |
medium | 6.7 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-20511 In SurfaceFlinger, there is a possible memory corruption due to use after free. |
medium | 6.7 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-20515 In gpu, there is a possible system crash due to use after free. |
medium | 5.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-20517 In geniezone, there is a possible escalation of privilege due to use after free. |
medium | 6.7 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-20506 In Audio HAL, there is a possible escalation of privilege due to use after free. |
medium | 6.7 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-20507 In Audio HAL, there is a possible escalation of privilege due to use after free. |
medium | 6.7 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-20508 In Power HAL, there is a possible escalation of privilege due to type confusion. |
medium | 6.7 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-20509 In Power HAL, there is a possible out of bounds write due to a missing bounds ch... |
medium | 6.7 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-20512 In Audio HAL, there is a possible escalation of privilege due to improper input... |
medium | 6.7 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-20513 In Audio HAL, there is a possible information disclosure due to improper input v... |
medium | 4.4 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-20514 In Audio HAL, there is a possible information disclosure due to a missing permis... |
medium | 4.4 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-77698 Zohocorp ManageEngine Endpoint Central versions before 11.5.2605.01 are vulnerab... |
medium | 5.7 | — | — | 2026-09-07 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.