September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-95625 The Tauri updater plugin verifies update binaries using minisign signatures, but... |
medium | 5.9 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-91817 A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’... |
medium | 6.1 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-01 |
| CVE-2026-91818 A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript ha... |
medium | 5.5 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-91810 A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’... |
medium | 6.1 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-91814 A signature validation vulnerability exists in Foxit PDF Editor/Reader’s handlin... |
medium | 5.5 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-29 |
| CVE-2026-91802 A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader... |
medium | 5.5 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-91807 A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’... |
medium | 6.1 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-15 |
| CVE-2026-91808 A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor Reader’... |
medium | 6.1 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-91796 The interface of Foxit PDF Editor/Reader lacks the permission verification for s... |
medium | 6.1 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-91788 When implementing the JavaScript interface, Foxit PDF Editor/Reader did not perf... |
medium | 5.5 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-29 |
| CVE-2026-5924 The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross... |
medium | 6.4 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-6831 The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing aut... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93510 The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not v... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93511 The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webh... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-89331 The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the me... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-90985 The WPC Smart Compare for WooCommerce WordPress plugin before 6.6.1 does not app... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-91024 The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape... |
medium | 6.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-91025 The Booking Manager WordPress plugin before 2.1.21 does not verify that a reques... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-91073 The Subscribe Forms WordPress plugin before 1.6.3 does not sanitise and escape o... |
medium | 6.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-86783 The Post Grid Gutenberg Blocks WordPress plugin before 5.0.41 does not perform a... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-86785 The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-86842 The Real3D Flipbook WordPress plugin before 5.4 does not perform capability chec... |
medium | 6.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-87979 The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the re... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-87981 The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a cap... |
medium | 4.7 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-88929 The Product Badge, Label, Countdown Timer for WooCommerce WordPress plugin befor... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-88997 The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escap... |
medium | 6.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-84098 The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPr... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-84150 The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPr... |
medium | 5.4 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-84168 The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidde... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-84741 The Events Calendar WordPress plugin before 6.17.5 does not check the post statu... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-85006 The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an... |
medium | 6.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-86602 The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capabili... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-86603 The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisati... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-80342 The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.27 does n... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-81338 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not pro... |
medium | 4.6 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-81339 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not per... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-83555 The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not veri... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-84026 The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPr... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-84027 The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPr... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-84046 The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPr... |
medium | 5.0 | — | — | 2026-09-23 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.