September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-97301 Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions. |
medium | 6.5 | — | — | 2026-09-30 | 2026-10-23 |
| CVE-2026-97279 Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions. |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97282 Unauthenticated Insecure Direct Object References (IDOR) in Review Schema <= 3.1... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97285 Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions. |
medium | 5.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97286 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-97261 Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions. |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97262 Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97266 Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97267 Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 vers... |
medium | 4.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97270 Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0 versions. |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97242 Author Arbitrary File Deletion in WEBO MCP <= 3.0.18 versions. |
medium | 6.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97243 Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions. |
medium | 5.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97246 Deserialization of Untrusted Data vulnerability in ShortPixel ShortPixel Image O... |
medium | 4.9 | — | — | 2026-09-30 | 2026-10-20 |
| CVE-2026-97247 Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions. |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97249 Unauthenticated Bypass Vulnerability in Paid Member Subscriptions <= 3.0.9 versi... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97236 Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions. |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97238 Subscriber Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions. |
medium | 5.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97239 Subscriber Broken Access Control in MCP Content Manager Lite <= 1.1.0 versions. |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97066 Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 ver... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97067 Contributor Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.7 versions... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97074 Subscriber Insecure Direct Object References (IDOR) in Newsletters, Email Market... |
medium | 4.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97078 Unauthenticated Insecure Direct Object References (IDOR) in Client Invoicing by... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97079 Subscriber Insecure Direct Object References (IDOR) in Webba Booking <= 6.5.0 ve... |
medium | 4.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96834 Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions. |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96835 Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.85 v... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96824 Editor Arbitrary File Deletion in Template Kit – Import <= 1.0.16 versions. |
medium | 6.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96825 Subscriber Bypass Vulnerability in All In One WP Security & Firewall <= 5.4.8 ve... |
medium | 4.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96829 Contributor Cross Site Scripting (XSS) in The Plus Addons for Elementor Page Bui... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96821 Subscriber Privilege Escalation in FluentBoards <= 2.0.12 versions. |
medium | 6.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96450 Contributor Cross Site Scripting (XSS) in pixfort Core < 4.3.3 versions. |
medium | 5.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96338 Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 versions. |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96347 Subscriber Insecure Direct Object References (IDOR) in Bookly <= 28.2 versions. |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94672 Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versio... |
medium | 4.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94673 Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appo... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94674 Contributor Cross Site Scripting (XSS) in Pixel Manager for WooCommerce <= 1.69.... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94681 Unauthenticated Denial of Service Attack in WP Store Locator < 3.0.0 versions. |
medium | 5.9 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94173 Contributor Insecure Direct Object References (IDOR) in Business Directory <= 6.... |
medium | 5.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94077 Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions. |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94074 Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-86778 Observable response discrepancy vulnerability in Maksisoft Technology, IT, and S... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.