September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-95396 A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8f... |
medium | 4.3 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-93341 MarketKing plugin for WordPress before 2.1.72 contains a missing authorization v... |
medium | 4.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-93342 MarketKing plugin for WordPress before 2.1.72 contains a missing authorization v... |
medium | 5.4 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-93343 MarketKing plugin for WordPress before 2.1.72 contains a missing authorization v... |
medium | 6.5 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-95273 A vulnerability was determined in dgtlmoon changedetection.io up to 0.60.7. |
medium | 4.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95623 The Tauri HTTP plugin validates requested URLs against the application's configu... |
medium | 5.6 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-25262 Memory corruption while processing a crafted ELF file in the Primary Bootloader. |
medium | 6.3 | — | Qualcomm / mdm9207 firmware | 2026-09-22 | 2026-10-06 |
| CVE-2026-15095 The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & So... |
medium | 4.9 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-95503 A flaw was found in the Kerberos federation provider of Keycloak, an open-source... |
medium | 6.8 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-9004 The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerab... |
medium | 4.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-91092 The wpForo Forum plugin for WordPress is vulnerable to authorization bypass in a... |
medium | 4.3 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-74765 Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read vi... |
medium | 6.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-7622 The ThumbPress plugin for WordPress is vulnerable to unauthorized access in vers... |
medium | 4.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-18439 The Tutor LMS – eLearning and online course solution plugin for WordPress is vul... |
medium | 4.3 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-1645 The Hostel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via... |
medium | 4.4 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-4123 The RW Elephant Rental Inventory plugin for WordPress is vulnerable to Missing A... |
medium | 4.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-16778 The Live Composer – Free WordPress Website Builder plugin for WordPress is vulne... |
medium | 6.4 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-18345 The WP User Manager plugin for WordPress is vulnerable to unauthorized modificat... |
medium | 4.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2025-1280 The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal... |
medium | 6.5 | — | — | 2026-09-22 | 2026-10-14 |
| CVE-2026-12995 The Custom Field Template plugin for WordPress is vulnerable to Insecure Direct... |
medium | 4.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2025-14484 The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modifi... |
medium | 5.3 | — | — | 2026-09-22 | 2026-10-14 |
| CVE-2025-14486 The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletio... |
medium | 5.3 | — | — | 2026-09-22 | 2026-10-14 |
| CVE-2025-14487 The Handily plugin for WordPress is vulnerable to unauthorized payment settings... |
medium | 5.3 | — | — | 2026-09-22 | 2026-10-14 |
| CVE-2026-85653 The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-... |
medium | 6.4 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-88788 The Text Styler WordPress plugin through 1.1.1 does not sanitise and escape user... |
medium | 6.8 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-93655 The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site... |
medium | 6.1 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-94492 A security vulnerability has been detected in Yonyou U8cloud 5.x. |
medium | 6.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-93709 Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivale... |
medium | 5.3 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-93711 Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response head... |
medium | 6.5 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-76974 SAP Fiori Launchpad does not sufficiently validate certain user-controlled input... |
medium | 5.3 | — | — | 2026-09-22 | 2026-09-22 |
| CVE-2026-94625 vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConn... |
medium | 5.3 | — | Vllm / vllm | 2026-09-21 | 2026-09-29 |
| CVE-2026-94532 lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the... |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-94533 lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in File... |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94536 lamp-cloud through 5.10.0 fails to validate the employeeId parameter in the /any... |
medium | 4.3 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-88756 Pagekit CMS <= 1.0.18 allows an unauthenticated attacker to perform SQL injectio... |
medium | 5.3 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-93340 Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerabi... |
medium | 6.8 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-78806 An issue in Matter Standard Specification-Implementation gap v1.5.1 Matter Proje... |
medium | 5.5 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-59815 Joplin is an open source note-taking and to-do application that organises notes... |
medium | 4.3 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-59830 Discourse is an open-source discussion platform. |
medium | 5.4 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-61743 Chartbrew is an open-source web application that can connect directly to databas... |
medium | 6.3 | — | — | 2026-09-21 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.