September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-40534 An improper neutralization of input during web page generation ('cross-site scri... |
medium | 5.4 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-40535 An improper limitation of a pathname to a restricted directory ('path traversal'... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-21822 HCLSoftware AppScan 360° was affected by a Path Traversal vulnerability in the A... |
medium | 6.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2025-13533 The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-... |
medium | 4.4 | — | — | 2026-09-18 | 2026-10-14 |
| CVE-2026-13623 An improper neutralization of input during web page generation ('Cross-site Scri... |
medium | 4.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-13635 An improper encoding or escaping of output vulnerability in Auth API in Synology... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-92249 The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cros... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-92554 The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-92622 The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site... |
medium | 6.4 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-93493 A flaw was found in Netty's `netty-handler-ssl-ocsp` component. |
medium | 5.9 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-75961 The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vuln... |
medium | 4.9 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-85652 The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-90981 The Newsletter – Send awesome emails from WordPress plugin for WordPress is vuln... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-16777 The Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Custome... |
medium | 4.9 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-17586 The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cr... |
medium | 6.4 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-17607 The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-67101 HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF... |
medium | 5.8 | — | Hcltech / bigfix service management | 2026-09-18 | 2026-10-08 |
| CVE-2026-67103 HCL BigFix Service Management is affected by Cross-Site Scripting (XSS) vulnerab... |
medium | 6.1 | — | Hcltech / bigfix service management | 2026-09-18 | 2026-10-08 |
| CVE-2026-13471 The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for W... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-14472 The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Sit... |
medium | 6.4 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-15004 The FileBird – WordPress Media Library Folders & File Manager plugin for WordPre... |
medium | 5.4 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-12739 The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPr... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-11757 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-92714 The Download Manager plugin for WordPress is vulnerable to Insecure Direct Objec... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-89278 The GPTranslate – Multilingual AI Translation Agent for WordPress: Translate You... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-89330 The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos,... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-90976 The Clean Login WordPress plugin before 1.19 does not check whether user registr... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-90977 The Clean Login WordPress plugin before 1.19 does not verify its registration CA... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-91707 The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-92561 The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-75017 The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-79713 The Breeze Cache WordPress plugin before 2.5.15 does not include a set of tracki... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-84909 The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress... |
medium | 6.4 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-86796 The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a reque... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-86800 The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-88994 The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a blo... |
medium | 6.6 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-89138 The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2024-38639 An improper authentication vulnerability has been reported to affect product. |
medium | 4.8 | — | — | 2026-09-18 | 2026-09-28 |
| CVE-2026-12106 The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side... |
medium | 6.4 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-17576 The InfiniteWP Client plugin for WordPress is vulnerable to SQL Injection via th... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.