September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-97165 Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gall... |
medium | 6.1 | — | Svenbluege / event gallery | 2026-09-27 | 2026-10-27 |
| CVE-2026-100749 Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gall... |
medium | 4.3 | — | Svenbluege / event gallery | 2026-09-27 | 2026-10-27 |
| CVE-2026-100747 Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extensi... |
medium | 6.5 | — | Svenbluege / event gallery | 2026-09-27 | 2026-10-20 |
| CVE-2026-89135 A failed X509_verify_cert call permanently plants an unverified attacker CA in t... |
medium | 6.5 | — | Wolfssl / wolfssl | 2026-09-27 | 2026-10-02 |
| CVE-2026-94417 When an application enables both OCSP and CRL revocation checking on one WOLFSSL... |
medium | 5.3 | — | Wolfssl / wolfssl | 2026-09-27 | 2026-09-29 |
| CVE-2026-89102 In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation fl... |
medium | 6.5 | — | Wolfssl / wolfssl | 2026-09-27 | 2026-09-30 |
| CVE-2026-89133 wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate valid... |
medium | 5.3 | — | Wolfssl / wolfssl | 2026-09-27 | 2026-10-02 |
| CVE-2026-15442 In all builds that make use of (D)TLS, including default builds, there is a seri... |
medium | 5.3 | — | Wolfssl / wolfssl | 2026-09-27 | 2026-10-02 |
| CVE-2026-94419 Without NO_SESSION_CACHE_REF, wolfSSL_get_session() does not return a session ob... |
medium | 5.4 | — | Wolfssl / wolfssl | 2026-09-27 | 2026-09-30 |
| CVE-2026-96899 The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralis... |
medium | 6.8 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-97227 The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does... |
medium | 5.9 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-97319 The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.2 does... |
medium | 6.8 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-89003 The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a... |
medium | 4.1 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-89006 The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize... |
medium | 6.8 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-92436 The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authe... |
medium | 5.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-92995 The Verge3D Publishing and E-Commerce WordPress plugin through 4.13.0 does not r... |
medium | 5.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-96895 The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attribut... |
medium | 6.8 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-96897 The Optima Express IDX WordPress plugin before 8.7.6 does not perform any author... |
medium | 5.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-89000 The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a... |
medium | 4.1 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-89001 The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not verify th... |
medium | 4.9 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-86841 The Online Scheduling and Appointment Booking System WordPress plugin before 28.... |
medium | 4.7 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-85002 The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block at... |
medium | 6.8 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-84069 The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of it... |
medium | 5.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-82841 The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, Up... |
medium | 5.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100863 Heym versions 0.0.90 and earlier contain two server-side request forgery (SSRF)... |
medium | 5.0 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100858 heym before 0.0.109 contains a server-side request forgery vulnerability in the... |
medium | 6.8 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100859 Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST... |
medium | 6.5 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100860 heym before 0.0.105 does not act on the result of the credential authorization l... |
medium | 5.5 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100861 heym before 0.0.105 fails to apply egress guards to integration services that us... |
medium | 5.0 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100862 heym, a workflow automation platform, stores and returns multiple capability sec... |
medium | 4.9 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100853 In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to veri... |
medium | 5.9 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100854 AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquid... |
medium | 6.3 | — | — | 2026-09-27 | 2026-10-08 |
| CVE-2026-100855 AzuraCast before 0.23.6 contains a missing permission check vulnerability in the... |
medium | 6.5 | — | — | 2026-09-27 | 2026-10-08 |
| CVE-2026-100745 A vulnerability has been found in Edimax BR-6428nC 1.16. |
medium | 6.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100834 http4k's Digest authentication module (org.http4k:http4k-security-digest) before... |
medium | 5.9 | — | — | 2026-09-27 | 2026-10-29 |
| CVE-2026-100836 Contrast through 1.20.0 contains a panic vulnerability in the transit-engine end... |
medium | 4.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100724 http4k (Maven package org.http4k:http4k-core) before 6.49.0.0, 5.42.0.0 and 4.51... |
medium | 5.4 | — | — | 2026-09-27 | 2026-10-29 |
| CVE-2026-100725 http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.... |
medium | 6.5 | — | — | 2026-09-27 | 2026-10-29 |
| CVE-2026-100722 vm2 before 3.12.2 does not apply host-side Promise rejection handling in the san... |
medium | 6.8 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2025-71422 Contrast is a Kubernetes runtime for confidential containers. |
medium | 5.7 | — | — | 2026-09-27 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.