September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-18317 The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-75016 The Magazine Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 6.4 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-88798 The Really Simple Security WordPress plugin before 9.8.3 does not validate a cli... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-88993 The All Bootstrap Blocks WordPress plugin through 1.3.31 does not properly escap... |
medium | 6.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-90984 The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not res... |
medium | 5.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-85350 The UpsellWP WordPress plugin before 2.2.10 does not check that products added t... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-87965 The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessabl... |
medium | 4.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-87966 The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an owners... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-84902 The King Addons for Elementor WordPress plugin before 51.1.81 does not perform a... |
medium | 6.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-85009 The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-85123 The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not vali... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-14855 The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripti... |
medium | 6.4 | — | — | 2026-09-18 | 2026-10-14 |
| CVE-2026-15650 The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin for WordPr... |
medium | 6.4 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-92991 The Biggop Library is vulnerable to Cross-Site Scripting via the ‘display_id’ pa... |
medium | 5.4 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-82982 The Approval app's approve/reject endpoint is meant to require the file's curren... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-82985 The Photos app's filter-based "smart albums" build their file listing using the... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-93313 A vulnerability was found in Freedesktop Poppler 26.07.0. |
medium | 6.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-93314 A vulnerability was determined in Freedesktop Poppler 26.07.0. |
medium | 6.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93455 django-page-cms through 2.0.13 fails to properly validate page permissions in ad... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-77164 Circles' remote-instance signature verification fetches the attacker-supplied ke... |
medium | 6.2 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-77169 A vulnerability in the team folders (formerly group folders) app when used in co... |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-77170 The Deck config API allows authenticated users to set board-scoped configuration... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-82980 Any authenticated user can lock or unlock files they do not own by targeting abs... |
medium | 6.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-93310 A vulnerability was identified in O-RAN-SC SMO OAM 2025-06-10. |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-93311 A vulnerability was detected in Freedesktop Poppler 26.07.0. |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93312 A flaw has been found in Freedesktop Poppler 26.07.0. |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93309 A vulnerability was determined in O-RAN-SC SMO OAM 2025-06-10. |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93451 snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed S... |
medium | 6.5 | — | — | 2026-09-18 | 2026-10-08 |
| CVE-2026-93454 Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and rend... |
medium | 5.4 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93308 A vulnerability was found in O-RAN-SC SMO OAM 2025-06-10. |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-83946 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Microsoft / azure portal | 2026-09-18 | 2026-09-25 |
| CVE-2026-18441 The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-2585 The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site... |
medium | 6.4 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-55946 Ai command injection in Microsoft Copilot allows an unauthorized attacker to dis... |
medium | 5.9 | — | Microsoft / copilot | 2026-09-17 | 2026-10-14 |
| CVE-2026-93307 A vulnerability has been found in O-RAN-SC SMO OAM 2025-06-10. |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-73638 Imager versions from 0.45_02 before 1.035 for Perl read outside the EXIF block v... |
medium | 6.2 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-54643 CubeCart is an ecommerce software solution. |
medium | 5.4 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-54644 CubeCart is an ecommerce software solution. |
medium | 6.1 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-54645 CubeCart is an ecommerce software solution. |
medium | 4.8 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54648 CubeCart is an ecommerce software solution. |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.