September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-73463 On affected platforms running Arista EOS, when multiple gRPC Network Security In... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-77955 In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONE... |
medium | 4.4 | — | Nlnetlabs / unbound | 2026-09-16 | 2026-09-23 |
| CVE-2026-78227 NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulne... |
medium | 6.5 | — | Nlnetlabs / unbound | 2026-09-16 | 2026-09-23 |
| CVE-2026-73445 On affected platforms running Arista EOS, an issue with the gRPC Network Securit... |
medium | 4.9 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-86341 GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 bef... |
medium | 4.4 | — | Gitlab / gitlab | 2026-09-16 | 2026-09-28 |
| CVE-2026-89207 A vulnerability has been identified in WTV676-HB6035 Web Interface (All versions... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-92091 A flaw was found in jwcrypto. |
medium | 5.9 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-81326 QND uses a hard-coded cryptographic key, which may allow a local attacker who is... |
medium | 5.5 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-27553 A low-privileged remote attacker can manipulate the schema path parameter in the... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-19 |
| CVE-2026-78252 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3... |
medium | 6.1 | — | Gitlab / gitlab | 2026-09-16 | 2026-09-28 |
| CVE-2026-7514 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.9... |
medium | 4.3 | — | Gitlab / gitlab | 2026-09-16 | 2026-09-28 |
| CVE-2026-84906 The Eventin WordPress plugin before 4.1.24 does not verify that a completed paym... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-86475 The Appointment Hour Booking WordPress plugin before 1.5.95 does not check every... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-8030 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0... |
medium | 4.3 | — | Gitlab / gitlab | 2026-09-16 | 2026-09-28 |
| CVE-2026-19619 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0... |
medium | 4.7 | — | Gitlab / gitlab | 2026-09-16 | 2026-09-28 |
| CVE-2026-19857 The Formidable Forms WordPress plugin before 6.35 does not prevent a request-der... |
medium | 4.8 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-3855 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2.... |
medium | 6.8 | — | Gitlab / gitlab | 2026-09-16 | 2026-09-28 |
| CVE-2026-13407 The Royal Elementor Addons WordPress plugin before 1.7.1067 does not properly sa... |
medium | 5.4 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-16794 GitLab has remediated an issue in GitLab EE affecting all versions from 18.11 be... |
medium | 4.3 | — | Gitlab / gitlab | 2026-09-16 | 2026-09-28 |
| CVE-2024-11222 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0... |
medium | 6.4 | — | Gitlab / gitlab | 2026-09-16 | 2026-09-28 |
| CVE-2026-86823 The Newsletter WordPress plugin before 9.3.7 does not validate the destination o... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-87828 The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a c... |
medium | 5.7 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-87854 The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correct... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-87860 The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-87896 The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any a... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-87907 The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any a... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-87959 The WPBot WordPress plugin before 8.7.6 does not perform a capability check on t... |
medium | 5.4 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-88910 The kboard WordPress plugin before 6.7 does not verify ownership or context befo... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-92358 A flaw was found in the first broker login flow of Keycloak. |
medium | 6.4 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-85349 The FluentBoards WordPress plugin before 2.0.15 does not properly verify authori... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-85572 The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has acces... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-85641 The Formidable Forms WordPress plugin before 6.35 does not restrict who can set... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-86445 The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilit... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-86447 The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilit... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-86449 The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilit... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-86784 The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a char... |
medium | 6.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-82124 The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-82125 The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-84088 The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does... |
medium | 6.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-85131 The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or c... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.