September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100629 Capgo (capgo.app backend) before 12.127.5 contains an authorization flaw in the... |
medium | 5.5 | — | — | 2026-09-26 | 2026-10-05 |
| CVE-2026-100630 AVideo before 29.1.0 contains a stored cross-site scripting vulnerability in the... |
medium | 5.4 | — | — | 2026-09-26 | 2026-10-04 |
| CVE-2026-100632 Parse Server is an open-source backend server. |
medium | 6.5 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100633 SiYuan is a self-hosted personal knowledge management system. |
medium | 6.5 | — | — | 2026-09-26 | 2026-10-05 |
| CVE-2026-100634 SiYuan before v3.8.4 does not validate the sender or restrict recipients in the... |
medium | 4.7 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100621 Capgo (capgo.app) contains an incomplete access-control/content-lock enforcement... |
medium | 4.3 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100624 Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle stat... |
medium | 5.4 | — | — | 2026-09-26 | 2026-10-05 |
| CVE-2026-100626 capgo through 12.128.2 contains an insecure direct object reference vulnerabilit... |
medium | 4.3 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100628 capgo.app before 12.128.12 fails to enforce an organization's API key expiration... |
medium | 4.3 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100616 capgo.app is an over-the-air update platform for Capacitor apps. |
medium | 5.5 | — | — | 2026-09-26 | 2026-10-05 |
| CVE-2026-100609 Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up... |
medium | 6.8 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100611 Capgo (capgo.app backend, versions ≤ 12.261.0) improperly restricts which roles... |
medium | 6.5 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100613 capgo.app is an over-the-air (OTA) update platform for Capacitor apps. |
medium | 5.3 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100601 ClawHub (openclaw/clawhub) application/backend contains a server-side request fo... |
medium | 5.3 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100602 ClawHub (openclaw/clawhub application/backend) contains a missing authorization... |
medium | 6.5 | — | — | 2026-09-26 | 2026-09-29 |
| CVE-2026-100603 ClawHub (openclaw/clawhub) application/backend contains a flaw in the skill repo... |
medium | 5.4 | — | — | 2026-09-26 | 2026-09-29 |
| CVE-2026-100604 ClawHub (openclaw/clawhub) contains an incorrect authorization vulnerability in... |
medium | 5.4 | — | — | 2026-09-26 | 2026-10-05 |
| CVE-2026-100600 ClawHub (the openclaw/clawhub application/backend) does not bind anonymous HTTP... |
medium | 5.3 | — | — | 2026-09-26 | 2026-10-05 |
| CVE-2026-100313 A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to... |
medium | 4.3 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100312 A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project u... |
medium | 6.3 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-92411 The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the... |
medium | 6.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-96531 The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attribu... |
medium | 6.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-96533 The Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-... |
medium | 5.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-19708 The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated... |
medium | 5.9 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-84097 The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a val... |
medium | 6.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-89237 The Bluff Post WordPress plugin through 1.1.1 does not sanitise and escape param... |
medium | 6.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-11871 The Team Members WordPress plugin before 9.3 does not perform any authorization... |
medium | 5.3 | — | — | 2026-09-26 | 2026-09-29 |
| CVE-2026-100595 OpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability... |
medium | 6.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-15273 The Automatic.css plugin for WordPress is vulnerable to Stored Cross-Site Script... |
medium | 6.4 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100590 OpenClaw before 2026.7.1 contains an authorization bypass vulnerability in the /... |
medium | 4.3 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100591 OpenClaw is an npm-distributed agent gateway. |
medium | 6.3 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100592 OpenClaw is an agent gateway distributed via npm. |
medium | 6.3 | — | — | 2026-09-26 | 2026-10-05 |
| CVE-2026-100593 OpenClaw (npm package `openclaw`) before 2026.7.1 does not enforce the documente... |
medium | 5.4 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100594 OpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability... |
medium | 6.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100582 OpenClaw channel plugins (@openclaw/msteams, @openclaw/feishu, @openclaw/matrix,... |
medium | 6.5 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100583 OpenClaw Discord versions before 2026.7.1 contain an authorization bypass vulner... |
medium | 4.3 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100584 OpenClaw is an npm-distributed agent runtime. |
medium | 6.7 | — | — | 2026-09-26 | 2026-10-05 |
| CVE-2026-100576 OpenClaw versions before 2026.8.1 contain a server-side request forgery vulnerab... |
medium | 5.4 | — | — | 2026-09-26 | 2026-10-05 |
| CVE-2026-100577 OpenClaw versions before 2026.8.1 fail to validate video asset URLs returned by... |
medium | 6.3 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100581 OpenClaw for iOS before 2026.8.11 stores Gateway credentials as cleartext JSON i... |
medium | 5.5 | — | — | 2026-09-26 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.