September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92899 Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured... |
medium | 4.8 | — | Apache / wss4j | 2026-09-30 | 2026-10-02 |
| CVE-2026-62078 Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.1... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-62079 Contributor Cross Site Scripting (XSS) in Qi Addons For Elementor <= 1.11 versio... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-62080 Contributor Cross Site Scripting (XSS) in Happy Addons for Elementor <= 3.23.1 v... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-62081 Contributor Insecure Direct Object References (IDOR) in Flexible PDF Coupons <=... |
medium | 5.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-62083 Subscriber Other Vulnerability Type in Creator LMS <= 1.2.19 versions. |
medium | 5.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103116 A weakness has been identified in OS4ED openSIS-Classic up to 9.3. |
medium | 6.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103117 A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. |
medium | 4.7 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102386 Subscriber Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.003 versi... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102399 Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic... |
medium | 5.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103115 A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3. |
medium | 6.3 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-102384 Author Cross Site Scripting (XSS) in Supreme Modules Lite <= 2.5.63 versions. |
medium | 5.9 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-100508 Unauthenticated Denial of Service Attack in Two Factor <= 0.16.0 versions. |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-100513 Contributor Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103114 A vulnerability was identified in OS4ED openSIS-Classic up to 9.3. |
medium | 6.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103113 A vulnerability was determined in OS4ED openSIS-Classic up to 9.3. |
medium | 4.7 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-13719 An authenticated user can list alert rules stored in folders they are not allowe... |
medium | 4.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-13720 An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana... |
medium | 5.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94029 Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 t... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-93995 Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-93996 Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versi... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102588 A flaw was found in Moodle. |
medium | 6.5 | — | Moodle / moodle | 2026-09-30 | 2026-10-01 |
| CVE-2026-92712 The ReactPress – Create React App for WordPress plugin for WordPress is vulnerab... |
medium | 6.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-93908 The Real Estate Manager – Property Listing and Agent Management plugin for WordP... |
medium | 6.4 | — | — | 2026-09-30 | 2026-10-21 |
| CVE-2026-102580 A flaw was found in Moodle. |
medium | 4.3 | — | Moodle / moodle | 2026-09-30 | 2026-10-01 |
| CVE-2026-102581 A flaw was found in Moodle. |
medium | 5.4 | — | Moodle / moodle | 2026-09-30 | 2026-10-01 |
| CVE-2026-102582 A flaw was found in Moodle. |
medium | 4.3 | — | Moodle / moodle | 2026-09-30 | 2026-10-01 |
| CVE-2026-102584 A flaw was found in Moodle. |
medium | 4.3 | — | Moodle / moodle | 2026-09-30 | 2026-10-01 |
| CVE-2026-102585 A flaw was found in Moodle. |
medium | 4.3 | — | Moodle / moodle | 2026-09-30 | 2026-10-01 |
| CVE-2026-102586 A flaw was found in Moodle. |
medium | 6.1 | — | Moodle / moodle | 2026-09-30 | 2026-10-01 |
| CVE-2026-102577 A flaw was found in Moodle. |
medium | 4.3 | — | Moodle / moodle | 2026-09-30 | 2026-10-01 |
| CVE-2026-102579 A flaw was found in Moodle. |
medium | 4.3 | — | Moodle / moodle | 2026-09-30 | 2026-10-01 |
| CVE-2026-102456 EasyFlow .NET developed by Digiwin has an SQL Injection vulnerability. |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102457 EasyFlow .NET developed by Digiwin has an Arbitrary File Read vulnerability. |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102459 EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerab... |
medium | 6.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2025-14564 The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross... |
medium | 6.4 | — | — | 2026-09-30 | 2026-10-14 |
| CVE-2026-93464 A stored cross-site scripting vulnerability via custom content descriptions exis... |
medium | 5.4 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-92872 Pgpool-II inserts sensitive information into log file, which may allow an authen... |
medium | 4.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-93460 A stored cross-site scripting vulnerability via appended strings in email form f... |
medium | 5.4 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-93462 A missing authentication for critical function vulnerability exists in baserCMS. |
medium | 5.3 | — | — | 2026-09-30 | 2026-10-01 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.