September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-85678 The AI Builder WordPress plugin before 2.7.8 does not sanitise custom JavaScript... |
medium | 6.8 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-86780 The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and... |
medium | 6.8 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-86781 The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin befor... |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-86782 The Visualizer WordPress plugin before 4.0.6 does not properly authorise access... |
medium | 5.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-86812 The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to... |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-86815 The BackWPup WordPress plugin before 5.7.5 does not properly restrict access to... |
medium | 5.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-14562 The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not perform a... |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-14565 The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform... |
medium | 5.4 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-14566 The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform... |
medium | 4.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-82305 The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify tha... |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-83545 The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom sk... |
medium | 6.8 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-89160 PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_I... |
medium | 6.5 | — | Pcre / pcre2 | 2026-09-11 | 2026-09-16 |
| CVE-2026-89156 PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback whe... |
medium | 5.9 | — | Pcre / pcre2 | 2026-09-11 | 2026-09-16 |
| CVE-2026-89158 PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow... |
medium | 6.5 | — | Pcre / pcre2 | 2026-09-11 | 2026-09-16 |
| CVE-2026-84960 The WP-Members Membership Plugin plugin for WordPress is vulnerable to Reflected... |
medium | 6.1 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-7438 The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site S... |
medium | 6.4 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-78172 The Themify – WooCommerce Product Filter plugin for WordPress is vulnerable to R... |
medium | 6.1 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-77150 The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Refle... |
medium | 6.1 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-19985 The Relevanssi – A Better Search plugin for WordPress is vulnerable to Reflected... |
medium | 6.1 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-18562 The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is... |
medium | 6.1 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-18964 The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeC... |
medium | 6.1 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-12215 The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authe... |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-11496 The Woo PDF Invoice Builder plugin (also distributed as "PDF Builder for WooComm... |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-11446 The Booktics – Booking Calendar for Appointments and Service Businesses plugin f... |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-11 |
| CVE-2026-88914 A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. |
medium | 4.4 | — | — | 2026-09-11 | 2026-09-16 |
| CVE-2026-89092 The nscd service in the GNU C Library 2.3.4 onwards may crash due to a
stack ov... |
medium | 4.2 | — | — | 2026-09-11 | 2026-10-26 |
| CVE-2026-89145 Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin dir... |
medium | 4.2 | — | — | 2026-09-11 | 2026-09-24 |
| CVE-2026-78129 strongSwan 4.6.2 through 6.0.7 has an infinite loop in PKCS#5 decryption. |
medium | 5.9 | — | Strongswan / strongswan | 2026-09-11 | 2026-09-14 |
| CVE-2026-78123 strongSwan 5.0.2 through 6.0.7 has an Expired Pointer Dereference in PKCS#7 pars... |
medium | 5.9 | — | Strongswan / strongswan | 2026-09-11 | 2026-09-15 |
| CVE-2026-78126 strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka... |
medium | 5.9 | — | Strongswan / strongswan | 2026-09-11 | 2026-09-14 |
| CVE-2026-82100 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
medium | 6.5 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-86087 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an authenti... |
medium | 4.3 | — | Ibm / db2 | 2026-09-10 | 2026-09-14 |
| CVE-2026-82092 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
medium | 6.5 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-81554 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
medium | 6.5 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-80434 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
medium | 5.0 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-79590 A NULL pointer dereference vulnerability exists in the Prism parser component of... |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-22 |
| CVE-2026-79723 IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacke... |
medium | 5.0 | — | Langflow / langflow | 2026-09-10 | 2026-09-16 |
| CVE-2026-79725 IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacke... |
medium | 6.5 | — | Langflow / langflow | 2026-09-10 | 2026-09-16 |
| CVE-2026-80378 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
medium | 6.5 | — | Ibm / datastage on cloud pak for data | 2026-09-10 | 2026-09-16 |
| CVE-2026-71642 An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e... |
medium | 4.0 | — | — | 2026-09-10 | 2026-09-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.