September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,293
Critical
1,225
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-19081 Missing Authorization vulnerability in Gastromenum Gastromenum Ticket and QR Men... |
medium | 4.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-77818 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-19727 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-14466 It’s possible to run a stored XSS in Stormshield’s web administration panel. |
medium | 4.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-80180 Stored XSS via markdown HTML processing in Apache Allura. |
medium | 6.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-80190 Apache Allura: stored XSS via SVN code repositories. |
medium | 6.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-86309 A flaw has been found in itsourcecode Sales and Inventory System 1.0. |
medium | 6.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-86321 A vulnerability was found in java-json-tools jackson-coreutils 2.0. |
medium | 5.3 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-2390 The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting v... |
medium | 6.4 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-17509 The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL I... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-2520 The Online Scheduling and Appointment Booking System – Bookly plugin for WordPre... |
medium | 5.4 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-12757 The The Email Subscribers & Newsletters – Email Marketing, Post Notifications &... |
medium | 6.5 | — | — | 2026-09-07 | 2026-09-08 |
| CVE-2026-85517 A flaw has been found in code-projects Vehicle Management System 1.0. |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85522 A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85637 A security flaw has been discovered in jofpin trape 1.0.0/2.0. |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-18404 The Social Chat – Click To Chat App Button plugin for WordPress is vulnerable to... |
medium | 6.4 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-83628 The Theme My Login plugin for WordPress is vulnerable to Missing Authorization i... |
medium | 4.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-8623 The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for... |
medium | 6.4 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-8625 The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for... |
medium | 6.4 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-14975 The WP File Download plugin for WordPress is vulnerable to Directory Traversal i... |
medium | 6.5 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-18843 The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable t... |
medium | 6.1 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-3853 The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Script... |
medium | 6.4 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-4361 The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all... |
medium | 5.0 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-75018 The Custom Contact Forms plugin for WordPress is vulnerable to authorization byp... |
medium | 4.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-75586 The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Refle... |
medium | 6.1 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-85414 The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site... |
medium | 6.4 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-76573 The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to... |
medium | 6.4 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-12843 The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in... |
medium | 5.4 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-15550 The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Au... |
medium | 4.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-81802 Unauthenticated Insecure Direct Object References (IDOR) in WpEvently <= 5.6.0 v... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-32773 There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which... |
medium | 6.1 | — | Apache / spark | 2026-09-02 | 2026-09-08 |
| CVE-2026-85308 Authorization Bypass Through User-Controlled Key vulnerability in Brainstorm For... |
medium | 5.3 | — | — | 2026-09-03 | 2026-09-07 |
| CVE-2026-85311 Missing Authorization vulnerability in Kings Plugins MarketKing allows Exploitin... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-07 |
| CVE-2026-84769 Unauthenticated Insecure Direct Object References (IDOR) in Business Directory <... |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-07 |
| CVE-2026-85302 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-07 |
| CVE-2026-27086 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-07 |
| CVE-2026-85305 Server-Side Request Forgery (SSRF) vulnerability in SEOPress allows Server Side... |
medium | 5.4 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-85309 Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allo... |
medium | 5.3 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-85106 A vulnerability has been found in NousResearch hermes-agent 0.18.0. |
medium | 6.3 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-84758 Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions. |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-05 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.