September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-18957 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 5.4 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-84045 The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 doe... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85534 A flaw was found in libsoup. |
medium | 5.9 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-27347 Missing Authorization vulnerability in Crocoblock JetPopup allows Exploiting Inc... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-85541 DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerabi... |
medium | 5.4 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-81666 An integer overflow was found in Corosync's handling of membership commit token... |
medium | 6.5 | — | — | 2026-09-04 | 2026-10-21 |
| CVE-2026-84043 The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does no... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-84044 The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not ve... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-27086 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-07 |
| CVE-2026-85311 Missing Authorization vulnerability in Kings Plugins MarketKing allows Exploitin... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-07 |
| CVE-2026-85528 Improper input validation of the auto-configuration account identifier in Snowfl... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-27432 Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vi... |
medium | 5.4 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-32480 Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiti... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-6217 Use of a One-Way hash without a salt vulnerability in Pik Online Software Soluti... |
medium | 6.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-80190 Apache Allura: stored XSS via SVN code repositories. |
medium | 6.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85229 ** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of input during web page... |
medium | 6.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-84146 The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-79632 The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-80180 Stored XSS via markdown HTML processing in Apache Allura. |
medium | 6.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-80438 The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilit... |
medium | 5.9 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-81347 The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not proper... |
medium | 5.9 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-82186 The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate... |
medium | 4.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-82193 The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does n... |
medium | 5.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-82194 The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does n... |
medium | 5.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-71216 PagerDuty alarm hook transmits the integration routing key over cleartext HTTP. |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-74853 The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a dis... |
medium | 6.8 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-79630 The WPFunnels WordPress plugin before 3.13.0 does not verify that the product re... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-79631 The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-17517 The Content Views WordPress plugin before 4.5.1.2 does not check whether the use... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2025-15691 The WPFunnels WordPress plugin before 3.13.0 does not check whether user registr... |
medium | 5.3 | — | — | 2026-09-04 | 2026-10-19 |
| CVE-2026-85407 A vulnerability was found in Eleveo Quality Management 9.7.0. |
medium | 4.3 | — | — | 2026-09-04 | 2026-10-20 |
| CVE-2026-85408 A vulnerability was determined in Eleveo Quality Management 9.7.0. |
medium | 4.3 | — | — | 2026-09-04 | 2026-10-20 |
| CVE-2026-85409 A vulnerability was identified in Eleveo Quality Management 9.7.0. |
medium | 6.3 | — | — | 2026-09-04 | 2026-10-20 |
| CVE-2026-85149 SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentia... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85401 A weakness has been identified in Dolibarr up to 21.0.4/22.0.5/23.0.3. |
medium | 6.3 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-85382 A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99... |
medium | 4.3 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-85383 A flaw has been found in itsourcecode Sales and Inventory System 1.0. |
medium | 6.3 | — | — | 2026-09-04 | 2026-09-11 |
| CVE-2026-85381 A security vulnerability has been detected in light0011 cms c774dce31c6df0055568... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-49509 Out-of-bounds read vulnerability in Samsung Opensource rLottie allows Overread B... |
medium | 4.4 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85453 MOOS core-moos through 10.4.0 fails to escape database contents when rendering M... |
medium | 6.1 | — | Themoos / core-moos | 2026-09-03 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.