September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-89263 MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEma... |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-15 |
| CVE-2026-89264 MoguBlog through 6.2 fails to validate the comment author identity in the POST /... |
medium | 4.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89265 MoguBlog through 6.2 contains an authorization bypass vulnerability in the POST... |
medium | 4.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-8304 Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Rese... |
medium | 5.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89261 MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mog... |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89012 Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerab... |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-23 |
| CVE-2026-15439 The GamiPress plugin for WordPress is vulnerable to authenticated (Subscriber+)... |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-85083 The ANJIA AJL33PC0801 IP camera uses a hard-coded credential for bootloader auth... |
medium | 6.8 | — | — | 2026-09-11 | 2026-09-18 |
| CVE-2026-89298 A flaw was found in the Dynamic Client Registration service of Keycloak, an open... |
medium | 4.9 | — | — | 2026-09-11 | 2026-09-16 |
| CVE-2026-57843 NetBSD contains an information disclosure vulnerability in mm_open() within sys/... |
medium | 5.5 | — | — | 2026-09-11 | 2026-09-24 |
| CVE-2026-89257 AVideo through 29.0 contains an insecure direct object reference (IDOR) vulnerab... |
medium | 5.4 | — | — | 2026-09-11 | 2026-09-15 |
| CVE-2026-89258 Hugo is a static site generator. |
medium | 6.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89251 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate... |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89252 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify o... |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-15 |
| CVE-2026-89244 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a r... |
medium | 6.1 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89245 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a c... |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89246 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a C... |
medium | 5.4 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89247 WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier conta... |
medium | 6.1 | — | — | 2026-09-11 | 2026-09-15 |
| CVE-2026-89248 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is missing an aut... |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89148 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an open... |
medium | 5.4 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89239 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a r... |
medium | 6.1 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89240 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a r... |
medium | 6.1 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89241 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a r... |
medium | 6.1 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2024-12145 The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Refe... |
medium | 4.3 | — | — | 2026-09-11 | 2026-10-27 |
| CVE-2026-86809 The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify... |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-86813 The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline c... |
medium | 4.8 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-82215 The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 do... |
medium | 5.9 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-85116 The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin from 1.2.2 before... |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-77159 A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() fun... |
medium | 5.5 | — | — | 2026-09-11 | 2026-09-16 |
| CVE-2026-82213 The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that th... |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-87123 hbs is an Express view engine wrapper for Handlebars. |
medium | 5.9 | — | — | 2026-09-11 | 2026-09-16 |
| CVE-2026-87859 morgan is an HTTP request logger middleware for Node.js. |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-16 |
| CVE-2026-87727 a-blog cms Ver. |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-16 |
| CVE-2026-89179 WeenyGenius, a computer lab management system by Howyar Technologies, has a Miss... |
medium | 4.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-6642 The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-S... |
medium | 6.4 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89173 Smart Video Intercom System developed by Kingdom Communication Associated has a... |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89175 Smart Video Intercom System developed by Kingdom Communication Associated has a... |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-6641 The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-S... |
medium | 6.4 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-6640 The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-S... |
medium | 6.4 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-83546 The CoolClock WordPress plugin before 4.3.8 does not properly escape a skin sett... |
medium | 6.8 | — | — | 2026-09-11 | 2026-09-11 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.