September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-76553 The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a pat... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-76555 The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a use... |
medium | 6.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-76556 The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanit... |
medium | 6.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-76557 The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanit... |
medium | 6.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-76558 The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom... |
medium | 6.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-76559 The WP Import Export Lite WordPress plugin before 3.9.33 does not properly valid... |
medium | 4.1 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-77702 The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-78474 The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not have any... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-5920 The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Sc... |
medium | 6.4 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-18555 The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots pl... |
medium | 6.1 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-16588 The WP Directory Kit plugin for WordPress is vulnerable to blind SQL Injection v... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-11996 The Advanced Popups plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 6.4 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-11984 The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-86109 The VeloCloud Edge software update workflow may accept update bundles without pr... |
medium | 6.6 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-92220 A vulnerability was found in vllm-project vLLM 0.26.0/0.27.0. |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-92221 A vulnerability was determined in gedelumbung HospitalManagement up to c2d455437... |
medium | 4.7 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92247 A security vulnerability has been detected in synaptikcms synaptik-cms up to 1.3... |
medium | 4.7 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-73450 On affected platforms running Arista EOS with MLAG Dual Primary Detection config... |
medium | 6.9 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-92298 EspoCRM through 10.0.8 uses PHP's rand() function to generate tokens for lead-ca... |
medium | 4.8 | — | — | 2026-09-16 | 2026-10-08 |
| CVE-2026-92216 A vulnerability was found in a2ui-project a2ui up to 0.10.7. |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-92217 A vulnerability was determined in a2ui-project a2ui up to 0.10.6. |
medium | 6.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-92213 A vulnerability was detected in a2ui-project a2ui up to 0.10.6. |
medium | 5.5 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-92184 A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. |
medium | 6.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-73460 On affected platforms running Arista EOS with IS-IS graceful restart enabled, an... |
medium | 6.1 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2025-11395 A flaw was found in Podman. |
medium | 5.5 | — | — | 2026-09-15 | 2026-10-27 |
| CVE-2026-92255 Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-92256 NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerabi... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-92257 Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulner... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-92259 Integer overflow or wraparound vulnerability in Samsung Opensource Escargot allo... |
medium | 5.5 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-82567 The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint... |
medium | 6.3 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-92114 A vulnerability was identified in a2ui-project a2ui up to 0.10.6. |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-76871 Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure v... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-76872 Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulner... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-76873 Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulner... |
medium | 5.2 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-76865 Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerabi... |
medium | 4.9 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-76867 Netcore NR255-V firmware version 1.5.130703 contains a stored cross-site scripti... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-76868 Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerabi... |
medium | 4.9 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-76859 Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure v... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-76863 Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure v... |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-76864 NR255-V version 1.5.130703 fails to sanitize QoS rule names before they are pars... |
medium | 4.8 | — | — | 2026-09-15 | 2026-09-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.