September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84801 Craft CMS versions before 5.10.11 fail to validate admin status in the actionGet... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84794 Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-a... |
high | 7.1 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-84759 Unauthenticated Cross Site Request Forgery (CSRF) in Activity Log <= 2.13.1 vers... |
high | 7.1 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84764 Unauthenticated Cross Site Request Forgery (CSRF) in Simply Schedule Appointment... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-84770 Unauthenticated Cross Site Request Forgery (CSRF) in Mang Board WP <= 2.3.8 vers... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-81770 Unauthenticated Cross Site Scripting (XSS) in Interactive Geo Maps <= 1.6.30 ver... |
high | 7.1 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-81771 Unauthenticated Cross Site Scripting (XSS) in TrustedSite <= 1.2.5 versions. |
high | 7.1 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-81772 Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles <= 3.0.31... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81774 Exposure of Sensitive System Information to an Unauthorized Control Sphere vulne... |
high | 7.5 | — | — | 2026-09-02 | 2026-10-12 |
| CVE-2026-81775 Unauthenticated Cross Site Scripting (XSS) in Estatik <= 4.3.4 versions. |
high | 7.1 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-81283 Subscriber PHP Object Injection in WP User Frontend <= 4.3.10 versions. |
high | 8.8 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-81288 Unauthenticated Cross Site Scripting (XSS) in Upsell Order Bump Offer for WooCom... |
high | 7.1 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-81289 Unauthenticated Cross Site Scripting (XSS) in MP3 Audio Player for Music, Radio... |
high | 7.1 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-81769 Incorrect Privilege Assignment vulnerability in LiquidThemes Booking Hub allows... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-19219 In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity p... |
high | 8.1 | — | — | 2026-09-02 | 2026-09-08 |
| CVE-2026-18672 In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation... |
high | 7.5 | — | — | 2026-09-02 | 2026-09-08 |
| CVE-2026-75528 The Broken Link Checker plugin for WordPress is vulnerable to Stored Cross-Site... |
high | 7.2 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-14828 Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 version... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-08 |
| CVE-2026-82883 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81737 The FAQ Builder AYS WordPress plugin before 1.8.5 does not sanitize or escape co... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81807 The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat messa... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-82183 The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the ident... |
high | 8.1 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-77792 The RegistrationMagic WordPress plugin before 6.0.9.9 does not escape a registra... |
high | 7.5 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-80467 The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not re... |
high | 8.1 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-19723 The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.... |
high | 7.1 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-14357 The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in ve... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-19116 The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-19453 The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capab... |
high | 7.1 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-12526 The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not ve... |
high | 8.1 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-12865 The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two re... |
high | 7.1 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2024-35585 Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for... |
high | 8.6 | — | — | 2026-09-02 | 2026-10-27 |
| CVE-2025-46418 Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media def... |
high | 7.6 | — | — | 2026-09-02 | 2026-10-19 |
| CVE-2026-14957 In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKe... |
high | 7.5 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-14982 The WP File Download plugin for WordPress is vulnerable to arbitrary file deleti... |
high | 8.1 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-84441 A security vulnerability has been detected in Piwigo up to 16.3.0. |
high | 7.3 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-84484 ION-DTN versions before 4.2.0 contain an out-of-bounds read vulnerability in the... |
high | 7.5 | — | — | 2026-09-02 | 2026-09-23 |
| CVE-2026-84485 APITable through 1.13.0-beta.1 exposes the internal organization loadOrSearch en... |
high | 7.5 | — | — | 2026-09-02 | 2026-09-23 |
| CVE-2026-84715 FeatherPanel versions before 1.3.7.10 fail to validate permissions in the Subuse... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-10 |
| CVE-2026-84700 PikiwiDB (Pika) v3.5.7 exposes an internal protobuf replication server on a port... |
high | 8.6 | — | — | 2026-09-02 | 2026-09-24 |
| CVE-2026-84702 facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name... |
high | 7.5 | — | — | 2026-09-02 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.