September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84898 The Eventin WordPress plugin before 4.1.21 does not properly validate a template... |
medium | 6.6 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84899 The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84901 The Eventin WordPress plugin before 4.1.22 does not properly check authorization... |
medium | 4.9 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84930 The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84931 The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or es... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84936 The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization... |
medium | 5.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84937 The Video Player for YouTube WordPress plugin before 2.1.0 does not properly san... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-82846 The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape som... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-83543 The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied... |
medium | 4.1 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-83544 The Greenshift WordPress plugin before 13.2.0 does not properly escape a block a... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84021 The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84022 The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84221 The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifi... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84896 The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-78149 The Smart Post WordPress plugin before 4.0.8 does not check whether a post is pa... |
medium | 5.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-81423 The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a use... |
medium | 4.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-81424 The Accept Stripe Payments WordPress plugin before 2.1.4 does not verify that th... |
medium | 5.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-18843 The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable t... |
medium | 6.1 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-19861 The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2... |
medium | 4.7 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-3853 The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Script... |
medium | 6.4 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-4361 The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all... |
medium | 5.0 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-14975 The WP File Download plugin for WordPress is vulnerable to Directory Traversal i... |
medium | 6.5 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-15247 The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or... |
medium | 5.4 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-83628 The Theme My Login plugin for WordPress is vulnerable to Missing Authorization i... |
medium | 4.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-8623 The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for... |
medium | 6.4 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-8625 The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for... |
medium | 6.4 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2025-14945 The Events Manager - Calendar, Bookings, Tickets, and more! |
medium | 5.4 | — | — | 2026-09-05 | 2026-10-19 |
| CVE-2026-18404 The Social Chat – Click To Chat App Button plugin for WordPress is vulnerable to... |
medium | 6.4 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86137 In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka... |
medium | 6.1 | — | Xmlsoft / libxml2 | 2026-09-05 | 2026-09-15 |
| CVE-2026-52772 YesWiki is a wiki system written in PHP. |
medium | 5.5 | — | — | 2026-09-05 | 2026-09-09 |
| CVE-2026-52773 YesWiki is a wiki system written in PHP. |
medium | 6.1 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-52774 YesWiki is a wiki system written in PHP. |
medium | 6.1 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86100 Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when... |
medium | 6.4 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-52763 YesWiki is a wiki system written in PHP. |
medium | 6.5 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-86096 PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in Temperat... |
medium | 5.9 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-86097 PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability i... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-76925 A flaw was found in Flatpak. |
medium | 5.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85787 An incomplete list of disallowed inputs in the SQL validation component in Amazo... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85701 A vulnerability has been found in ramon-victor freegpt-webui up to 098db3dfeb415... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85703 A flaw has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca926... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-11 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.