September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-66579 Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.2.1 v... |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-66572 Contributor Cross Site Scripting (XSS) in JetBlog <= 2.4.10 versions. |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-66573 Contributor Cross Site Scripting (XSS) in JetTabs <= 2.3.3.1 versions. |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-66574 Contributor Cross Site Scripting (XSS) in Element Pack Elementor Addons <= 8.8.3... |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-92920 admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user... |
medium | 5.4 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92921 admin3 through 3.0.0 stores account passwords using single-round MD5 with only t... |
medium | 4.9 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92904 A flaw was found in the foreman_remote_execution plugin's template invocations c... |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-92912 AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 uses cryptographically w... |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-81441 Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Mis... |
medium | 5.5 | — | Dell / openmanage server administrator | 2026-09-17 | 2026-10-01 |
| CVE-2026-81479 Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Par... |
medium | 5.5 | — | Dell / openmanage server administrator | 2026-09-17 | 2026-10-02 |
| CVE-2026-78296 Insufficient Verification of Data Authenticity vulnerability in WP ManageNinja L... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-19 |
| CVE-2026-92893 A flaw was found in the foreman_ansible plugin's Ansible inventory API. |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-81439 Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an In... |
medium | 6.5 | — | Dell / openmanage server administrator | 2026-09-17 | 2026-10-01 |
| CVE-2026-92894 A flaw was found in the foreman_ansible plugin's Ansible override values API. |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-87829 The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin b... |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-87831 The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin b... |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-44940 The rancher-extension-stackstate extension in SUSE Observability exposes service... |
medium | 5.7 | — | — | 2026-09-17 | 2026-09-29 |
| CVE-2026-90982 @fastify/static is a Fastify plugin that serves static files from a configured r... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-91015 The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform a... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-91016 The Motors WordPress plugin before 1.4.121 does not verify that a request is aut... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-91019 The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not... |
medium | 4.9 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-90922 The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-90923 The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one... |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-91009 The Active Woot Products Tables for WooCommerce. |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-91010 The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPres... |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-91011 The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape... |
medium | 6.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-86788 The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict... |
medium | 6.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-86824 The Newsletter WordPress plugin before 9.3.8 does not generate its email trackin... |
medium | 4.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-92839 Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-86311 The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress... |
medium | 6.4 | — | — | 2026-09-17 | 2026-09-17 |
| CVE-2026-89064 The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Ins... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-61589 djust provides Phoenix LiveView-style reactive server-side rendering for Django... |
medium | 6.3 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-61588 djust provides Phoenix LiveView-style reactive server-side rendering for Django... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92595 Nodemailer (npm package `nodemailer`) versions 9.1.0 and earlier do not honor th... |
medium | 5.9 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92597 Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email a... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92598 Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding intern... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92585 AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to v... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92586 AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to v... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92587 n8n is a workflow automation platform. |
medium | 5.0 | — | — | 2026-09-16 | 2026-10-29 |
| CVE-2026-92588 n8n is a workflow automation platform. |
medium | 4.4 | — | — | 2026-09-16 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.