September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-19475 An authenticated user with permission to query a SQL data source can bypass the... |
medium | 6.5 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-12704 When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library... |
medium | 6.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-8151 The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does n... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-83533 The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-sid... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-83547 The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of i... |
medium | 6.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-82884 The All in One SEO WordPress plugin before 5.0.0.1 does not sanitise and escape... |
medium | 6.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-82293 Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lea... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81571 The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to... |
medium | 4.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-78599 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (... |
medium | 6.5 | — | Elastic / kibana | 2026-09-02 | 2026-09-03 |
| CVE-2026-78601 Missing Authorization (CWE-862) in Kibana can lead to information disclosure via... |
medium | 5.5 | — | Elastic / kibana | 2026-09-02 | 2026-09-03 |
| CVE-2026-78602 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (... |
medium | 5.3 | — | Elastic / maps server | 2026-09-02 | 2026-09-08 |
| CVE-2026-78609 Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead... |
medium | 5.4 | — | Elastic / elastic cloud on kubernetes | 2026-09-02 | 2026-09-04 |
| CVE-2026-78586 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lea... |
medium | 6.5 | — | Elastic / kibana | 2026-09-02 | 2026-09-03 |
| CVE-2026-78588 Allocation of Resources Without Limits or Throttling (CWE-770) in Filebeat can l... |
medium | 6.5 | — | Elastic / filebeat | 2026-09-02 | 2026-09-03 |
| CVE-2026-78591 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (... |
medium | 6.3 | — | Elastic / kibana | 2026-09-02 | 2026-09-03 |
| CVE-2026-78594 Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to... |
medium | 4.9 | — | Elastic / apm server | 2026-09-02 | 2026-09-03 |
| CVE-2026-78598 Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lea... |
medium | 5.4 | — | Elastic / kibana | 2026-09-02 | 2026-09-03 |
| CVE-2026-77793 The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the tota... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-77794 The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-78153 The Restrict User Access WordPress plugin before 2.8.1 does not normalise the RE... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-78584 Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead... |
medium | 4.3 | — | Elastic / kibana | 2026-09-02 | 2026-09-03 |
| CVE-2026-2688 The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authenticatio... |
medium | 6.5 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-2811 The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header In... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-10821 The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control c... |
medium | 6.6 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-14255 A maliciously crafted IFC file, when parsed through certain Autodesk products, c... |
medium | 5.5 | — | — | 2026-09-02 | 2026-10-27 |
| CVE-2026-17563 The User Frontend WordPress plugin before 4.3.11 does not enforce its subscripti... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2025-15481 The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticat... |
medium | 5.3 | — | — | 2026-09-02 | 2026-10-19 |
| CVE-2025-15489 The Passster WordPress plugin before 4.2.24 does not handle input properly in an... |
medium | 5.3 | — | — | 2026-09-02 | 2026-10-19 |
| CVE-2025-15490 The Passster WordPress plugin before 4.2.26 has a flaw in its global protection... |
medium | 5.3 | — | — | 2026-09-02 | 2026-10-19 |
| CVE-2025-8945 The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting p... |
medium | 5.3 | — | — | 2026-09-02 | 2026-10-19 |
| CVE-2024-3773 The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and e... |
medium | 5.9 | — | — | 2026-09-02 | 2026-10-27 |
| CVE-2026-81162 Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR B... |
medium | 5.3 | — | Dxpr Builder Project / dxpr builder | 2026-09-02 | 2026-09-09 |
| CVE-2026-81164 Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsin... |
medium | 5.4 | — | Entity Pdf Project / entity pdf | 2026-09-02 | 2026-10-07 |
| CVE-2026-81165 Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. |
medium | 5.3 | — | Blazy Project / blazy | 2026-09-02 | 2026-09-16 |
| CVE-2026-81166 Missing Authorization vulnerability in Drupal Digital Signage Framework allows F... |
medium | 5.3 | — | Lakedrops / digital signage framework | 2026-09-02 | 2026-09-16 |
| CVE-2026-81167 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 4.8 | — | Address Suggestion Project / address suggestion | 2026-09-02 | 2026-09-09 |
| CVE-2026-81201 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 6.1 | — | Monster Menus Project / monster menus | 2026-09-02 | 2026-09-16 |
| CVE-2026-81205 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injecti... |
medium | 5.3 | — | Miniorange / ldap \/ active directory integration | 2026-09-02 | 2026-09-16 |
| CVE-2026-81269 Missing Authorization vulnerability in Drupal Data field allows Forceful Browsin... |
medium | 5.3 | — | Data Field Project / data field | 2026-09-02 | 2026-09-09 |
| CVE-2026-76758 Vulnerability in Drupal Link content parser. |
medium | 5.9 | — | — | 2026-09-02 | 2026-09-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.