September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-93463 A cross-site scripting vulnerability via script validation bypass exists in base... |
medium | 5.4 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-88037 The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Sc... |
medium | 6.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-92868 An improper certificate validation vulnerability exists in Pgpool-II, which may... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-92869 An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an aut... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-6170 The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Sc... |
medium | 6.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-6171 The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Sc... |
medium | 6.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-6172 The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Sc... |
medium | 6.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-6173 The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Sc... |
medium | 6.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-11895 The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin f... |
medium | 6.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-14876 The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scrip... |
medium | 6.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-16596 The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97316 The Broken Link Notifier WordPress plugin before 2.0.0.1 does not re-validate th... |
medium | 5.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-93580 The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94274 The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96886 The Course Booking System WordPress plugin before 7.0.9 does not restrict access... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-91051 The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenti... |
medium | 6.6 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-91072 The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-d... |
medium | 4.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-92424 The Content Egg WordPress plugin before 11.9.0 does not verify that a user runni... |
medium | 6.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-89190 The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user'... |
medium | 4.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-90953 The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended... |
medium | 4.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-86789 The Connections Business Directory WordPress plugin through 10.4.67 does not app... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-87777 The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize and escape a... |
medium | 6.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-85415 The Audio Player Block WordPress plugin before 1.6.3 does not validate the schem... |
medium | 6.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-85576 The All in One Files Upload WordPress plugin before 2.0.17 does not have any cap... |
medium | 4.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-80333 The Solace Extra WordPress plugin before 1.7.2 does not perform any authorizatio... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-83560 The New User Approve WordPress plugin before 3.2.10 does not properly verify aut... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-85001 The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of... |
medium | 6.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-75824 The User Frontend WordPress plugin before 4.3.12 does not check whether the site... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-100143 The FluentCart A New Era of eCommerce WordPress plugin before 1.6.5 does not ver... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102912 A vulnerability was identified in SourceCodester Online Leave Management System... |
medium | 4.7 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-86556 There is an information disclosure vulnerability in ZTE U30 Air. |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102906 A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66ea... |
medium | 6.3 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-78229 Image Scanner Driver for Linux contains an OS command injection vulnerability. |
medium | 6.7 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-81310 Image Scanner Driver for Linux contains a link following vulnerability. |
medium | 6.6 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102843 A security flaw has been discovered in gedelumbung HospitalManagement up to c2d4... |
medium | 4.7 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-102845 A security vulnerability has been detected in gedelumbung HospitalManagement up... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102846 A vulnerability was detected in gedelumbung HospitalManagement up to c2d45543789... |
medium | 4.7 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-102847 A flaw has been found in gedelumbung HospitalManagement up to c2d45543789a388706... |
medium | 4.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103057 AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerabilit... |
medium | 4.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102805 A flaw has been found in Nothings stb up to 1.16. |
medium | 6.5 | — | — | 2026-09-30 | 2026-10-01 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.