September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,313
Critical
1,226
High
4,359
Medium
4,108
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-72641 Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized modificatio... |
medium | 5.4 | — | Elastic / kibana | 2026-09-01 | 2026-09-02 |
| CVE-2026-84793 Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scr... |
medium | 4.8 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84805 Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contrac... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84808 Kimai versions before 2.65.0 contain an authorization bypass vulnerability in th... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84270 A flaw was found in the MTP backend in gvfs. |
medium | 4.3 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-72628 Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a de... |
medium | 6.5 | — | Elastic / kibana | 2026-09-01 | 2026-09-02 |
| CVE-2026-63138 Improper Neutralization of Special Elements in Data Query Logic (CWE-943) in Kib... |
medium | 6.5 | — | Elastic / kibana | 2026-09-01 | 2026-09-02 |
| CVE-2026-33465 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lea... |
medium | 6.5 | — | Elastic / kibana | 2026-09-01 | 2026-09-02 |
| CVE-2026-84425 A vulnerability was found in zhayujie CowAgent up to 2.1.3. |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84430 A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. |
medium | 6.3 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84442 A vulnerability was identified in MapQuest Get Directions App 10.16.1 on Android... |
medium | 4.4 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-83562 Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 versions. |
medium | 6.5 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84760 Unauthenticated Broken Access Control in Ultimate Gift Cards For WooCommerce <=... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84771 Unauthenticated Insecure Direct Object References (IDOR) in PublishPress Permiss... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84775 Unauthenticated Denial of Service Attack in Really Simple SSL <= 9.8.0 versions. |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84792 Craft CMS versions before 5.10.11 contain a broken access control vulnerability... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84797 Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability... |
medium | 6.3 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84802 Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure v... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84267 A flaw was found in the SFTP backend in gvfs. |
medium | 4.3 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-11873 An Apache-proxied Dogtag CA REST endpoint exposed by IdM (POST /ca/rest/certrequ... |
medium | 6.5 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-84232 A flaw was found in pulpcore's content serving application. |
medium | 5.4 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-51742 Incorrect access control in the discoverWan function of TOTOLINK T6 4.1.5cu.748_... |
medium | 5.9 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-51745 Incorrect access control in the updatePriStaList function of TOTOLINK T6 4.1.5cu... |
medium | 5.3 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-51748 Incorrect access control in the sendStaticInfoToMaster function of TOTOLINK T6 4... |
medium | 5.9 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-51752 Incorrect access control in the staticInfoSend function of TOTOLINK T6 4.1.5cu.7... |
medium | 5.3 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-51756 Incorrect access control in the meshSlaveUpgfw function of TOTOLINK T6 4.1.5cu.7... |
medium | 5.9 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-51761 Incorrect access control in the updateLanIp function of TOTOLINK T6 4.1.5cu.748_... |
medium | 5.3 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-13611 The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks... |
medium | 5.3 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-74916 The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tra... |
medium | 6.5 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-78363 The MW WP Form WordPress plugin before 5.1.5 does not prevent shortcodes in user... |
medium | 4.8 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82926 NULL pointer dereference vulnerability in Samsung Open Source mTower allows Poin... |
medium | 5.5 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82927 Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows... |
medium | 5.5 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-10420 Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows... |
medium | 5.5 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-84109 A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. |
medium | 6.3 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-12747 The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cr... |
medium | 6.4 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-13203 The Live Composer – Free WordPress Website Builder plugin for WordPress is vulne... |
medium | 6.4 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-17589 The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generi... |
medium | 4.9 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-18752 The Persistent Login plugin for WordPress is vulnerable to generic SQL Injection... |
medium | 6.5 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-19948 The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58... |
medium | 5.3 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-75965 The User Profile Builder – Beautiful User Registration Forms, User Profiles & Us... |
medium | 6.4 | — | — | 2026-09-01 | 2026-09-01 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.