September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,313
Critical
1,226
High
4,359
Medium
4,108
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-96346 Author SQL Injection in WP ERP <= 1.17.9 versions. |
high | 7.6 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96343 Custom role PHP Object Injection in WP ERP <= 1.17.9 versions. |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-95531 Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 ver... |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-95587 Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions. |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-95104 Stack-based buffer overflow vulnerability exists in BUFFALO Wi-Fi products. |
high | 7.5 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-94683 Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions. |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94677 Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.1... |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94678 Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions. |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94499 Subscriber Broken Access Control in FormGent <= 1.12.2 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94178 Subscriber Privilege Escalation in Import and export users and customers <= 2.5.... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94120 Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <=... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94121 Contributor PHP Object Injection in 10Web Booster – Website speed optimization,... |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94122 Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions. |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94123 Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions. |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94082 Author SQL Injection in Quiz Cat <= 3.1.1 versions. |
high | 7.6 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94115 Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions. |
high | 8.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94078 Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94081 Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94076 Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 version... |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-93651 Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2... |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-93770 Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-93771 Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 vers... |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-93621 Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions. |
high | 8.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-93624 Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versi... |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-93512 Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-93514 Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5.2... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-62085 Administrator SQL Injection in WP Activity Log <= 5.6.6 versions. |
high | 7.6 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-27371 Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102874 A vulnerability was identified in HKUDS AnyTool 0.1.0. |
high | 7.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102909 A vulnerability was identified in SourceCodester Online Reviewer Management Syst... |
high | 7.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102395 Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps <= 1.14.6 version... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102396 Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic <= 1.5.... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102398 Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versi... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102385 Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2024-42002 A code injection vulnerability has been discovered in the Robot Operating System... |
high | 8.4 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-102616 A vulnerability was detected in risesoft-y9 WorkFlow-Engine up to 9.6.10. |
high | 7.3 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-94286 An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 c... |
high | 7.1 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-86530 BUFFALO Wi-Fi products handle some web form input improperly to assemble command... |
high | 7.2 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-100638 SiYuan versions before v3.8.4 contain a path traversal vulnerability in the setN... |
high | 7.6 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100605 Flowise through 3.1.4 contains missing route-level RBAC checks on chat message e... |
high | 7.1 | — | — | 2026-09-26 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.