September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-94108 getID3 through 1.9.26 contains an XML external entity injection vulnerability in... |
medium | 6.5 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-94111 Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerabili... |
medium | 6.6 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-94112 mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use... |
medium | 6.8 | — | — | 2026-09-20 | 2026-09-24 |
| CVE-2026-94105 NivoCart through 2.4.0 contains a destructive configuration write vulnerability... |
medium | 5.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-86555 The ZTE SmartLife application has a hardcoded key. |
medium | 6.2 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-93971 A weakness has been identified in aiyiyi121 SxDevOps 1.0/1.1. |
medium | 5.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-86554 SmartLife app dynamically generates brand‑new SmartLife application authenticati... |
medium | 4.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-92422 The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user... |
medium | 6.5 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-93966 A vulnerability has been found in aiyiyi121 SxDevOps 1.0/1.1. |
medium | 4.7 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-93967 A vulnerability was found in aiyiyi121 SxDevOps 1.0/1.1. |
medium | 5.5 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-84223 The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files whi... |
medium | 6.8 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-87068 The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role va... |
medium | 6.6 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-87840 The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or own... |
medium | 5.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-92410 The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the... |
medium | 4.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-16542 The Import and export users and customers WordPress plugin before 2.4.5 does not... |
medium | 4.1 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-81653 The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not... |
medium | 4.2 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-14844 The Master Slider WordPress plugin through 3.11.2 does not sanitise and escape s... |
medium | 6.8 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-93964 A vulnerability was detected in NginxProxyManager nginx-proxy-manager up to 2.15... |
medium | 5.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-93965 A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. |
medium | 6.6 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-93963 A security vulnerability has been detected in itsourcecode Leave Management Syst... |
medium | 6.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-93961 A security flaw has been discovered in Dromara UJCMS up to 12.3.1. |
medium | 5.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-93960 A vulnerability was identified in Pixelfed up to 0.12.11. |
medium | 4.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-86552 SmartLife app dynamically generates brand‑new SmartLife application authenticati... |
medium | 5.4 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-93957 A vulnerability has been found in olivier-ls PHP-FTS up to 1.1.3. |
medium | 4.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-94057 Exim before 4.100.1 allows SMTP smuggling in which the received message does not... |
medium | 5.3 | — | Exim / exim | 2026-09-19 | 2026-09-24 |
| CVE-2026-93989 vLLM through 0.29.0 fails to properly validate bad_words token indices against t... |
medium | 4.3 | — | Vllm / vllm | 2026-09-19 | 2026-09-28 |
| CVE-2026-94054 Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled pro... |
medium | 5.3 | — | Exim / exim | 2026-09-19 | 2026-09-24 |
| CVE-2026-94055 Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS,... |
medium | 5.3 | — | Exim / exim | 2026-09-19 | 2026-09-24 |
| CVE-2026-93955 A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-93988 QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTM... |
medium | 6.5 | — | — | 2026-09-19 | 2026-10-08 |
| CVE-2026-93954 A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-22 |
| CVE-2026-93999 A flaw was found in the OIDC protocol implementation of Keycloak, an open-source... |
medium | 4.2 | — | — | 2026-09-19 | 2026-09-22 |
| CVE-2026-94000 A flaw was found in the Admin REST API of Keycloak, an open-source identity and... |
medium | 6.6 | — | — | 2026-09-19 | 2026-09-22 |
| CVE-2026-94001 A flaw was found in the Admin REST API of Keycloak, an open-source identity and... |
medium | 6.5 | — | — | 2026-09-19 | 2026-09-22 |
| CVE-2026-93981 hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a... |
medium | 4.7 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-93983 OpenPanel through 2.3.0 fails to escape property keys in ClickHouse SQL queries,... |
medium | 5.0 | — | — | 2026-09-19 | 2026-10-02 |
| CVE-2026-93984 OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic... |
medium | 5.3 | — | — | 2026-09-19 | 2026-10-02 |
| CVE-2026-9613 The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress is vulnerabl... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-9766 The Empik for Woocommerce plugin for WordPress is vulnerable to authorization by... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-9858 The Partial Shipment for Woocommerce plugin for WordPress is vulnerable to Missi... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.