September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,293
Critical
1,225
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-85307 Insertion of Sensitive Information Into Sent Data vulnerability in Kevin Pirnie... |
medium | 5.3 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-85303 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-85304 Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For... |
medium | 5.3 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84849 Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce <= 2.3 versio... |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84762 Unauthenticated Bypass Vulnerability in WP EasyPay <= 4.5.3 versions. |
medium | 5.3 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84755 Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions. |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84215 Unauthenticated Broken Access Control in Timetics <= 1.0.61 versions. |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84137 Spoofing issue in the DOM: Core & HTML component. |
medium | 4.3 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84138 Denial-of-service in the PDF Viewer component. |
medium | 6.5 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84139 Clickjacking issue in the DOM: Events component. |
medium | 6.1 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84136 Other issue in the DOM: Navigation component. |
medium | 6.1 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-82968 A flaw was found in the first-broker-login flow of the Keycloak identity managem... |
medium | 6.4 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2021-43613 An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2021-43614 Error in handling the PlatformLangCodes UEFI variable could cause a buffer overf... |
medium | 6.7 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-82293 Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lea... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-19251 The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comm... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-19704 The Comments WordPress plugin before 7.6.66 does not validate a value used to bu... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-19719 The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.... |
medium | 6.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-74927 The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisati... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-77764 The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its vid... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-77782 The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a pos... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-77788 The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metad... |
medium | 4.9 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-78151 The FormLayer WordPress plugin before 1.0.9 does not perform any authorization c... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-79621 The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content t... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81194 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not pro... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81195 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not per... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81197 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not res... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81199 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not per... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81426 The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81427 The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor s... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81428 The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the... |
medium | 6.5 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81432 The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CS... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81583 The My Login WordPress plugin before 7.2.0 does not enforce the network's regist... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-10821 The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control c... |
medium | 6.6 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-17563 The User Frontend WordPress plugin before 4.3.11 does not enforce its subscripti... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-2688 The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authenticatio... |
medium | 6.5 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-2811 The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header In... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-77793 The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the tota... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-77794 The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-78153 The Restrict User Access WordPress plugin before 2.8.1 does not normalise the RE... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.