September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-90473 msgpack-java through 0.9.12 contains an integer overflow vulnerability in Messag... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-23 |
| CVE-2026-90474 MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embe... |
medium | 6.8 | — | — | 2026-09-12 | 2026-09-23 |
| CVE-2026-77161 The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable... |
medium | 6.5 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-85198 The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin... |
medium | 6.5 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-17585 The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin f... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-11355 The DT LMS – elearning, WordPress LMS plugin for WordPress is vulnerable to unau... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-87891 The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any c... |
medium | 6.5 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-87892 The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the or... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-87894 The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any a... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-87916 The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-87918 The WPBot WordPress plugin before 8.5.7 does not perform any authorization or no... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-87919 The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does... |
medium | 4.9 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-86790 The WP Highlight Box WordPress plugin through 1.0 does not escape some shortcode... |
medium | 6.8 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-87797 The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capabilit... |
medium | 4.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-82847 The Masteriyo LMS WordPress plugin before 3.4.1 does not sanitise and escape one... |
medium | 6.8 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-83532 The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize a... |
medium | 6.8 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-84023 The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce or check use... |
medium | 6.5 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-84024 The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce before savin... |
medium | 4.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-77753 The Temporary Login Without Password WordPress plugin before 1.9.9 does not prev... |
medium | 5.5 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-78152 The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' register... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-77689 The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 d... |
medium | 5.3 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-89268 QloApps through 1.7.0 renders back-office list filter POST parameters into HTML... |
medium | 5.4 | — | — | 2026-09-12 | 2026-09-23 |
| CVE-2026-90467 aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by c... |
medium | 4.0 | — | — | 2026-09-12 | 2026-09-23 |
| CVE-2026-89267 starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchable_fi... |
medium | 4.3 | — | — | 2026-09-12 | 2026-09-23 |
| CVE-2026-90457 The administrative password is hashed using a comparatively weak, fast algorithm... |
medium | 6.2 | — | — | 2026-09-11 | 2026-10-02 |
| CVE-2026-90461 OpenStack Ironic through 38.0.0 may send a username and password to an unexpecte... |
medium | 6.3 | — | — | 2026-09-11 | 2026-10-09 |
| CVE-2026-90449 When a particular authentication mode is configured, the reverse proxy forwards... |
medium | 6.5 | — | — | 2026-09-11 | 2026-10-02 |
| CVE-2026-90450 The application's role-authorization lookup defaults to granting access when a r... |
medium | 4.3 | — | — | 2026-09-11 | 2026-10-02 |
| CVE-2026-90451 An example environment-configuration file ships with a fixed, publicly-known sec... |
medium | 5.9 | — | — | 2026-09-11 | 2026-10-02 |
| CVE-2026-90452 Requests from the reverse proxy to the identity-provider service for token disco... |
medium | 5.3 | — | — | 2026-09-11 | 2026-10-02 |
| CVE-2026-90454 A deployment mode intended to expose only read access to a bundled packet-analys... |
medium | 4.3 | — | — | 2026-09-11 | 2026-10-02 |
| CVE-2026-90443 A web interface reflects a portion of the request URL into a script context and... |
medium | 5.4 | — | — | 2026-09-11 | 2026-10-02 |
| CVE-2026-90445 An interface that accepts file uploads from authenticated users extracts the con... |
medium | 6.5 | — | — | 2026-09-11 | 2026-10-02 |
| CVE-2026-90446 An application programming interface endpoint accepts a user-supplied value and... |
medium | 4.3 | — | — | 2026-09-11 | 2026-10-02 |
| CVE-2026-90447 A routing rule selects between two different authentication mechanisms for the s... |
medium | 6.5 | — | — | 2026-09-11 | 2026-10-02 |
| CVE-2026-90448 A deployment mode intended to expose only read access to stored data proxies a s... |
medium | 6.5 | — | — | 2026-09-11 | 2026-10-02 |
| CVE-2026-54248 Doco-CD is a GitOps continuous delivery tool that automatically deploys and upda... |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-54258 ZoneMinder is a free, open source closed-circuit television software application... |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-48496 OpenTelemetry eBPF Profiler is a production-scale agent for profiling applicatio... |
medium | 6.2 | — | — | 2026-09-11 | 2026-09-25 |
| CVE-2026-50018 Hoverfly is an open source API simulation tool. |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.