September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,313
Critical
1,226
High
4,359
Medium
4,108
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-102323 Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102324 Use after free in PictureInPicture in Google Chrome prior to 154.0.8037.92 allow... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102326 Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102328 Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95322 Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-97293 Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions. |
high | 8.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97272 Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for Wo... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97250 Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97253 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97271 Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97241 Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions. |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97244 Contributor Path Traversal in Creator LMS <= 1.2.19 versions. |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97245 Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions. |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97197 Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 v... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97235 Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97240 Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96838 Unauthenticated Cross Site Request Forgery (CSRF) in Blacklist Manager – WooComm... |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97065 Unauthenticated Cross Site Scripting (XSS) in Happyforms <= 1.26.15 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97077 Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.18 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96830 Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96831 Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions. |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96832 Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions. |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96833 Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 vers... |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96836 Unauthenticated Cross Site Scripting (XSS) in Parsi Date <= 6.3 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96837 Contributor Remote Code Execution (RCE) in CartFlows <= 3.2.0 versions. |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96820 Subscriber Cross Site Scripting (XSS) in Awesome Support <= 6.3.9 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96823 Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96827 Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions. |
high | 7.6 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96828 Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions. |
high | 7.6 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96352 Unauthenticated Cross Site Scripting (XSS) in YITH WooCommerce Ajax Search <= 2.... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96814 Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <=... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96815 Custom role Privilege Escalation in Vitepos <= 3.5.0 versions. |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96816 Unauthenticated Cross Site Scripting (XSS) in Trusted Shops Easy Integration for... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96817 Subscriber Broken Access Control in MakeCommerce for WooCommerce <= 4.1.0 versio... |
high | 8.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96818 Unauthenticated Broken Access Control in WP Express Checkout (Accept PayPal Paym... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96819 Subscriber Cross Site Scripting (XSS) in oik <= 4.15.4 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96348 Unauthenticated Broken Access Control in Bookly <= 28.2 versions. |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96351 Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 6.1.3 versio... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96344 Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions. |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96345 Administrator SQL Injection in Estatik <= 4.3.5 versions. |
high | 7.6 | — | — | 2026-09-30 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.