September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-81432 The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CS... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81583 The My Login WordPress plugin before 7.2.0 does not enforce the network's regist... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-82182 The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does n... |
medium | 4.1 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-78151 The FormLayer WordPress plugin before 1.0.9 does not perform any authorization c... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-79621 The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content t... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81194 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not pro... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81195 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not per... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81197 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not res... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-19719 The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.... |
medium | 6.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-74927 The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisati... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-77764 The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its vid... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-77782 The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a pos... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-77788 The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metad... |
medium | 4.9 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-14215 The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 d... |
medium | 6.5 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-15232 The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-16966 The Solace Extra WordPress plugin before 1.7.0 does not perform any authorizatio... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-16983 The Gutentor WordPress plugin before 4.0.6 does not apply the correct context re... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-19251 The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comm... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-19704 The Comments WordPress plugin before 7.6.66 does not validate a value used to bu... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2025-15664 The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19... |
medium | 6.8 | — | — | 2026-09-02 | 2026-10-19 |
| CVE-2025-15663 The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19... |
medium | 6.8 | — | — | 2026-09-02 | 2026-10-19 |
| CVE-2026-3851 The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via th... |
medium | 6.4 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84442 A vulnerability was identified in MapQuest Get Directions App 10.16.1 on Android... |
medium | 4.4 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-82968 A flaw was found in the first-broker-login flow of the Keycloak identity managem... |
medium | 6.4 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84431 A vulnerability was detected in AirAsia MOVE App up to 12.47.1 on Android. |
medium | 4.4 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84701 NocoBase fails to sanitize rich text field values in the read renderer, allowing... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-16 |
| CVE-2026-84430 A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. |
medium | 6.3 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84697 Mailpit's IsInternalIP deny list function fails to block the Azure WireServer ad... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-10 |
| CVE-2026-84698 PX4 Autopilot contains a heap buffer overflow vulnerability in the sd_bench comm... |
medium | 6.5 | — | — | 2026-09-02 | 2026-09-10 |
| CVE-2026-84425 A vulnerability was found in zhayujie CowAgent up to 2.1.3. |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84427 A vulnerability was determined in zhayujie CowAgent up to 2.1.7. |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-84356 UI misrepresentation in FullScreen in Google Chrome prior to 152.0.7977.75 allow... |
medium | 4.3 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84357 Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 all... |
medium | 6.5 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84358 Improper privilege management in Downloads in Google Chrome prior to 152.0.7977.... |
medium | 4.2 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84332 Incorrect authorization in SiteSettings in Google Chrome prior to 152.0.7977.75... |
medium | 6.5 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84348 Information leak in MediaCapture in Google Chrome prior to 152.0.7977.75 allowed... |
medium | 6.5 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84323 Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allo... |
medium | 5.3 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84327 Incorrect authorization in Autofill in Google Chrome on on Android prior to 152.... |
medium | 6.5 | — | Google / chrome | 2026-09-02 | 2026-09-08 |
| CVE-2026-84329 Confused deputy in CredentialProvider in Google Chrome on on Windows prior to 15... |
medium | 5.3 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84330 UI misrepresentation in FullScreen in Google Chrome on on Android prior to 152.0... |
medium | 5.4 | — | Google / chrome | 2026-09-02 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.