September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-98078 In the Linux kernel, the following vulnerability has been resolved:
ipvs: fix r... |
medium | 4.4 | — | Linux / linux kernel | 2026-09-25 | 2026-10-19 |
| CVE-2026-98080 In the Linux kernel, the following vulnerability has been resolved:
btrfs: do n... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-19 |
| CVE-2026-98082 In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-19 |
| CVE-2026-98062 In the Linux kernel, the following vulnerability has been resolved:
bpf: Mark s... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-21 |
| CVE-2026-98051 In the Linux kernel, the following vulnerability has been resolved:
net: bcmasp... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-19 |
| CVE-2026-98053 In the Linux kernel, the following vulnerability has been resolved:
ASoC: Intel... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-21 |
| CVE-2026-98054 In the Linux kernel, the following vulnerability has been resolved:
ASoC: Intel... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-19 |
| CVE-2026-98059 In the Linux kernel, the following vulnerability has been resolved:
bpf: Mark s... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-29 |
| CVE-2026-98049 In the Linux kernel, the following vulnerability has been resolved:
bpf: zero e... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-21 |
| CVE-2026-80514 The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the so... |
medium | 5.3 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-86837 The Bookly WordPress plugin before 28.3 does not properly verify a customer's id... |
medium | 5.3 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-88848 The MasterStudy LMS WordPress plugin from 1.9 before 3.7.50 does not verify that... |
medium | 4.2 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-92573 Improper handling of compressed data in the shared GZIP decompressor used for AM... |
medium | 6.5 | — | Apache / qpid broker-j | 2026-09-25 | 2026-10-05 |
| CVE-2026-96448 A flaw was found in the Fine-Grained Admin Permissions (FGAP v2) feature of Keyc... |
medium | 6.6 | — | — | 2026-09-25 | 2026-09-26 |
| CVE-2026-93656 The User Profile Builder – Beautiful User Registration Forms, User Profiles & Us... |
medium | 6.4 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-93747 The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripti... |
medium | 6.4 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-17577 The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting... |
medium | 6.1 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-17602 The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress i... |
medium | 4.9 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-88996 The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Surv... |
medium | 6.1 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-13179 The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory &... |
medium | 6.4 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-12037 The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Serv... |
medium | 5.5 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-96766 The GeoDirectory – WP Business Directory Plugin and Classified Listings Director... |
medium | 6.4 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-97846 Keycloak provides a feature called mTLS holder-of-key binding which ensures that... |
medium | 6.8 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-93897 The GeoDirectory – WP Business Directory Plugin and Classified Listings Director... |
medium | 6.4 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-93899 The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots pl... |
medium | 6.5 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-94376 The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots pl... |
medium | 6.4 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-92212 The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnera... |
medium | 6.1 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-92746 The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPre... |
medium | 6.4 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-92799 The Online Scheduling and Appointment Booking System – Bookly plugin for WordPre... |
medium | 5.3 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-92829 The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vuln... |
medium | 4.3 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-78393 The Link Library WordPress plugin before 7.9.6 does not properly escape some par... |
medium | 6.1 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-78394 The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied... |
medium | 4.1 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-78397 The Link Library WordPress plugin before 7.9.6 does not validate the destination... |
medium | 4.0 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-19775 The OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin plugin f... |
medium | 4.3 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-97732 IRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticate... |
medium | 5.1 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-97736 tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. |
medium | 5.4 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2025-14814 The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-... |
medium | 6.4 | — | — | 2026-09-25 | 2026-10-14 |
| CVE-2026-97650 A vulnerability has been found in ningzichun student-management-system up to 987... |
medium | 4.3 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-97724 A prototype pollution vulnerability in Software Mansion React Native Worklets be... |
medium | 4.3 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-97648 A vulnerability was detected in ningzichun student-management-system up to 98760... |
medium | 4.3 | — | — | 2026-09-25 | 2026-09-25 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.