September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86211 A flaw has been found in rabindralamsal inventory-management-system 1.0.0. |
high | 7.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86209 A weakness has been identified in SourceCodester Class and Exam Timetabling Syst... |
high | 7.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86210 A security vulnerability has been detected in SourceCodester Class and Exam Time... |
high | 7.3 | — | — | 2026-09-06 | 2026-09-09 |
| CVE-2026-86208 A security flaw has been discovered in SourceCodester Class and Exam Timetabling... |
high | 7.3 | — | — | 2026-09-06 | 2026-09-10 |
| CVE-2026-86180 A vulnerability has been found in code-projects Task Management System In PHP 1.... |
high | 7.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-18480 The SureCart WordPress plugin before 4.6.3 does not ensure that the account affe... |
high | 8.8 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-84219 The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the... |
high | 7.5 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86168 A security flaw has been discovered in code-projects Content Management System 1... |
high | 7.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86166 A vulnerability was determined in Tenda HG10 300001138. |
high | 8.8 | — | — | 2026-09-06 | 2026-09-11 |
| CVE-2026-86161 A vulnerability was found in SourceCodester Online Voting System 1.0. |
high | 7.3 | — | — | 2026-09-06 | 2026-09-11 |
| CVE-2026-86162 A vulnerability was determined in SourceCodester Online Voting System 1.0. |
high | 7.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-18056 The HivePress Authentication plugin for WordPress is vulnerable to Authenticatio... |
high | 7.5 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86159 A flaw has been found in SourceCodester Online Voting System 1.0. |
high | 7.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-86160 A vulnerability has been found in SourceCodester Online Voting System 1.0. |
high | 7.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-67277 MikroTik RouterOS Missing Authentication for Critical Function Vulnerability |
high | 8.2 | Listed | MikroTik / RouterOS | 2026-09-05 | 2026-09-11 |
| CVE-2026-67281 RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jspr... |
high | 7.5 | — | Mikrotik / routeros | 2026-09-05 | 2026-09-25 |
| CVE-2026-67276 RouterOS does not compare the complete RSA public key when matching an SSH authe... |
high | 8.1 | — | Mikrotik / routeros | 2026-09-05 | 2026-09-25 |
| CVE-2026-6554 libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a sig... |
high | 7.5 | — | — | 2026-09-05 | 2026-10-22 |
| CVE-2026-0799 In BPF instructions that load/store a value from/to a scratch memory register th... |
high | 8.7 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86188 AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerabili... |
high | 7.2 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86185 Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wi... |
high | 8.0 | — | — | 2026-09-05 | 2026-09-23 |
| CVE-2025-9049 The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unaut... |
high | 8.8 | — | — | 2026-09-05 | 2026-10-19 |
| CVE-2026-86177 Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in... |
high | 8.8 | — | — | 2026-09-05 | 2026-09-24 |
| CVE-2026-86169 Axolotl before 0.19.0 contains a remote code execution vulnerability in the mult... |
high | 8.8 | — | — | 2026-09-05 | 2026-09-23 |
| CVE-2026-86173 MindsDB through 26.1.0 contains a server-side request forgery vulnerability in t... |
high | 7.5 | — | — | 2026-09-05 | 2026-09-23 |
| CVE-2026-86119 Webstudio through 0.296.0 contains an unauthenticated server-side request forger... |
high | 8.6 | — | — | 2026-09-05 | 2026-09-24 |
| CVE-2026-86123 SQL Chat contains four unauthenticated API endpoints that accept client-supplied... |
high | 8.7 | — | — | 2026-09-05 | 2026-09-24 |
| CVE-2026-86117 Coolify through 4.3.17 contains an authentication bypass vulnerability in the OA... |
high | 8.1 | — | — | 2026-09-05 | 2026-09-10 |
| CVE-2026-81543 The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Pri... |
high | 8.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-83625 The Contact Form by Supsystic plugin for WordPress is vulnerable to Stored Cross... |
high | 7.2 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84934 The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability che... |
high | 8.0 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84935 The HT Menu WordPress plugin before 1.2.7 does not perform any capability or obj... |
high | 8.0 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-82304 The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user... |
high | 8.6 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-77826 The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which appl... |
high | 8.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-77830 The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vu... |
high | 7.2 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-78438 The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scrip... |
high | 7.2 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-81404 The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape... |
high | 7.1 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-18406 The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plug... |
high | 7.2 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-19769 The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPr... |
high | 7.2 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-19858 The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2... |
high | 7.5 | — | — | 2026-09-05 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.