September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-81158 Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Brows... |
medium | 5.3 | — | Entity Api Project / entity api | 2026-09-02 | 2026-10-01 |
| CVE-2026-81160 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 6.1 | — | Slick Carousel Project / slick carousel | 2026-09-02 | 2026-10-01 |
| CVE-2026-76755 Vulnerability in Drupal Gammu SMS Daemon. |
medium | 5.9 | — | — | 2026-09-02 | 2026-09-19 |
| CVE-2026-76756 Vulnerability in Drupal Gammu SMS Daemon. |
medium | 5.9 | — | — | 2026-09-02 | 2026-09-19 |
| CVE-2026-76757 Vulnerability in Drupal Gammu SMS Daemon. |
medium | 5.9 | — | — | 2026-09-02 | 2026-09-19 |
| CVE-2026-73474 Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub a... |
medium | 5.3 | — | Entity Share Websub Project / entity share websub | 2026-09-02 | 2026-09-09 |
| CVE-2026-73476 Improper Handling of Case Sensitivity vulnerability in Drupal External Authentic... |
medium | 5.4 | — | External Authentication Project / external authentication | 2026-09-02 | 2026-09-15 |
| CVE-2026-73477 Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forceful Brows... |
medium | 5.3 | — | Quick Tabs Project / quick tabs | 2026-09-02 | 2026-09-16 |
| CVE-2026-73478 Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. |
medium | 5.3 | — | Diff Project / diff | 2026-09-02 | 2026-09-16 |
| CVE-2026-16647 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal... |
medium | 4.1 | — | Zyxware / disable login page | 2026-09-02 | 2026-09-08 |
| CVE-2026-18986 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 4.8 | — | Entity Browser Project / entity browser | 2026-09-02 | 2026-09-08 |
| CVE-2026-84835 Missing Authorization vulnerability in DimaFreund Rentsyst rentsyst allows Explo... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-23 |
| CVE-2026-84802 Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure v... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84804 Kimai before 2.65.0 fails to properly validate permissions when removing team ac... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-84805 Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contrac... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84806 Kimai before 2.63.0 contains an improper authorization vulnerability in team acc... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84807 Kimai (kimai/kimai) through 2.65.0 contains a business logic / improper authoriz... |
medium | 5.4 | — | — | 2026-09-02 | 2026-10-29 |
| CVE-2026-84808 Kimai versions before 2.65.0 contain an authorization bypass vulnerability in th... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84797 Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability... |
medium | 6.3 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84799 Craft CMS before 5.11.0 fails to enforce user-group scope filters on native Grap... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-84771 Unauthenticated Insecure Direct Object References (IDOR) in PublishPress Permiss... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84772 Editor Server Side Request Forgery (SSRF) in Broken Link Checker <= 2.4.14 versi... |
medium | 5.5 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84775 Unauthenticated Denial of Service Attack in Really Simple SSL <= 9.8.0 versions. |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84780 Unauthenticated Denial of Service Attack in WP Go Maps <= 10.1.08 versions. |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-84781 Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.4 versions. |
medium | 6.5 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84792 Craft CMS versions before 5.10.11 contain a broken access control vulnerability... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84793 Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scr... |
medium | 4.8 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84760 Unauthenticated Broken Access Control in Ultimate Gift Cards For WooCommerce <=... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-82223 Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.22 versions. |
medium | 6.5 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-83562 Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 versions. |
medium | 6.5 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84217 Missing Authorization vulnerability in Mamunur Rashid Classified Listing classif... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-23 |
| CVE-2026-66652 Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Tour allows... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-32773 There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which... |
medium | 6.1 | — | Apache / spark | 2026-09-02 | 2026-09-08 |
| CVE-2026-53683 reset_password.html parses query string parameters and uses the 'url' parameter... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-14 |
| CVE-2025-7963 The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site... |
medium | 6.4 | — | — | 2026-09-02 | 2026-10-19 |
| CVE-2026-3850 The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via th... |
medium | 6.4 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-81199 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not per... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81426 The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81427 The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor s... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81428 The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the... |
medium | 6.5 | — | — | 2026-09-02 | 2026-09-03 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.