September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-85117 The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode pars... |
medium | 6.5 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-87747 The Enterprise Cloud Database developed by Ragic has an Arbitrary File Read vuln... |
medium | 4.9 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-19802 The Checkout Custom Fields Builder for WooCommerce plugin for WordPress is vulne... |
medium | 4.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-19855 The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, use... |
medium | 6.5 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-84222 The Kirki WordPress plugin before 6.3.0 does not check whether the requester is... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-84908 The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in ver... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-85037 The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a cli... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-85132 The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or... |
medium | 4.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-85133 The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or... |
medium | 5.4 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-85418 The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fo... |
medium | 5.4 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-8615 The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauth... |
medium | 4.3 | — | — | 2026-09-09 | 2026-09-11 |
| CVE-2026-81022 The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-81741 The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin bef... |
medium | 4.7 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-82184 The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have any authoris... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-82185 The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability o... |
medium | 4.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-82848 The Masteriyo LMS WordPress plugin before 3.4.0 does not perform any authorizati... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-83541 The Sina Extension for Elementor WordPress plugin before 3.10.4 does not properl... |
medium | 6.8 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-84113 The Quentn WP WordPress plugin before 1.2.15 does not properly sanitise and esca... |
medium | 4.1 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-75861 The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not... |
medium | 6.5 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-75905 The WP Recipe Maker plugin for WordPress is vulnerable to authorization bypass i... |
medium | 4.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-80339 The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does n... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-80340 The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does n... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-80341 The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does n... |
medium | 5.9 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-81021 The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-18042 The WP Travel WordPress plugin before 12.0.2 does not verify that the requester... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-19946 The Awesome Support plugin for WordPress is vulnerable to Missing Authorization... |
medium | 4.3 | — | — | 2026-09-09 | 2026-09-11 |
| CVE-2025-15690 The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and... |
medium | 6.8 | — | — | 2026-09-09 | 2026-10-19 |
| CVE-2026-87737 An issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml. |
medium | 5.9 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-87732 An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. |
medium | 6.2 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-87733 An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. |
medium | 6.2 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-87735 An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. |
medium | 4.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-87736 An issue was discovered in the mirage-crypto-ec package before 2.3.0 for OCaml. |
medium | 4.3 | — | — | 2026-09-09 | 2026-09-14 |
| CVE-2026-21107 Out-of-bounds write in Samsung Notes prior to version 4.4.45.5 allows local atta... |
medium | 5.5 | — | Samsung / notes | 2026-09-09 | 2026-09-23 |
| CVE-2026-21108 Improper export of android application components in Bixby Touch prior to versio... |
medium | 5.5 | — | Samsung / bixby | 2026-09-09 | 2026-09-23 |
| CVE-2026-21112 Improper input validation in Samsung Tips prior to Android 17 allows local attac... |
medium | 5.5 | — | Samsung / android | 2026-09-09 | 2026-09-23 |
| CVE-2026-21113 Improper export of android application components in Visual Voicemail prior to v... |
medium | 5.5 | — | Samsung / visual voicemail | 2026-09-09 | 2026-09-23 |
| CVE-2026-21098 Improper access control in Link to Windows prior to SMR Sep-2026 Release 1 allow... |
medium | 6.1 | — | Samsung / android | 2026-09-09 | 2026-09-28 |
| CVE-2026-21099 Improper access control in SettingsProvider prior to SMR Sep-2026 Release 1 allo... |
medium | 5.5 | — | Samsung / android | 2026-09-09 | 2026-09-10 |
| CVE-2026-21101 Improper input validation in DualDAR driver prior to SMR Sep-2026 Release 1 allo... |
medium | 6.7 | — | Samsung / android | 2026-09-09 | 2026-09-11 |
| CVE-2026-21102 Use after free in DualDAR prior to SMR Sep-2026 Release 1 allows local privilege... |
medium | 6.7 | — | Samsung / android | 2026-09-09 | 2026-09-11 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.