September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84137 Spoofing issue in the DOM: Core & HTML component. |
medium | 4.3 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84138 Denial-of-service in the PDF Viewer component. |
medium | 6.5 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84122 Use-after-free in the Audio/Video component. |
medium | 5.4 | — | Mozilla / firefox | 2026-09-01 | 2026-09-02 |
| CVE-2026-84124 Use-after-free in the DOM: Core & HTML component. |
medium | 5.4 | — | Mozilla / firefox | 2026-09-01 | 2026-09-02 |
| CVE-2026-84125 Use-after-free in the DOM: Core & HTML component. |
medium | 5.4 | — | Mozilla / firefox | 2026-09-01 | 2026-09-02 |
| CVE-2026-84126 Incorrect boundary conditions in the Layout: Grid component. |
medium | 4.3 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84127 Information disclosure in the WebExtensions component in Firefox for Android. |
medium | 4.3 | — | Mozilla / firefox mobile | 2026-09-01 | 2026-09-03 |
| CVE-2026-84061 A security flaw has been discovered in zhongyu09 OpenChatBI up to 0.3.0. |
medium | 6.3 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-84118 Use-after-free in the JavaScript: GC component. |
medium | 5.4 | — | Mozilla / firefox | 2026-09-01 | 2026-09-02 |
| CVE-2026-84120 Use-after-free in the Audio/Video component. |
medium | 5.4 | — | Mozilla / firefox | 2026-09-01 | 2026-09-02 |
| CVE-2026-7877 The WP Recipe Maker Premium plugin for WordPress is vulnerable to Stored Cross-S... |
medium | 6.4 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-53682 An unauthenticated client can query the Security Domain hosts inventory via GET... |
medium | 5.3 | — | — | 2026-09-01 | 2026-09-23 |
| CVE-2026-51742 Incorrect access control in the discoverWan function of TOTOLINK T6 4.1.5cu.748_... |
medium | 5.9 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-51745 Incorrect access control in the updatePriStaList function of TOTOLINK T6 4.1.5cu... |
medium | 5.3 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-84188 LibreNMS versions <= 26.4.0 contain a stored cross-site scripting vulnerability... |
medium | 4.8 | — | — | 2026-09-01 | 2026-10-08 |
| CVE-2026-84191 LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in V... |
medium | 6.1 | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-77194 The Simple Membership plugin for WordPress is vulnerable to Authentication Bypas... |
medium | 5.3 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-11873 An Apache-proxied Dogtag CA REST endpoint exposed by IdM (POST /ca/rest/certrequ... |
medium | 6.5 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-10420 Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows... |
medium | 5.5 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2025-15613 Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via i... |
medium | 6.5 | — | — | 2026-09-01 | 2026-10-19 |
| CVE-2026-82926 NULL pointer dereference vulnerability in Samsung Open Source mTower allows Poin... |
medium | 5.5 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-82927 Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows... |
medium | 5.5 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-16786 The Live Composer – Free WordPress Website Builder plugin for WordPress is vulne... |
medium | 6.4 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-16788 The Live Composer – Free WordPress Website Builder plugin for WordPress is vulne... |
medium | 6.4 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-15101 The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Sit... |
medium | 6.4 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-74916 The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tra... |
medium | 6.5 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-78363 The MW WP Form WordPress plugin before 5.1.5 does not prevent shortcodes in user... |
medium | 4.8 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-13611 The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks... |
medium | 5.3 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-75964 The User Profile Builder – Beautiful User Registration Forms, User Profiles & Us... |
medium | 6.1 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-75980 The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot... |
medium | 6.4 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-77189 The Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Dona... |
medium | 6.5 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-18488 The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Sc... |
medium | 6.4 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-75965 The User Profile Builder – Beautiful User Registration Forms, User Profiles & Us... |
medium | 6.4 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-76006 The Photo Gallery by Ays – Responsive Image Gallery plugin for WordPress is vuln... |
medium | 4.9 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-77823 The LearnPress plugin for WordPress is vulnerable to SQL Injection via the 'orde... |
medium | 4.9 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-83743 A weakness has been identified in invoiceninja Invoice Ninja up to 5.13.26. |
medium | 6.3 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-83744 A security vulnerability has been detected in invoiceninja Invoice Ninja up to 5... |
medium | 4.3 | — | — | 2026-09-01 | 2026-09-02 |
| CVE-2026-18752 The Persistent Login plugin for WordPress is vulnerable to generic SQL Injection... |
medium | 6.5 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-19948 The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58... |
medium | 5.3 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-13203 The Live Composer – Free WordPress Website Builder plugin for WordPress is vulne... |
medium | 6.4 | — | — | 2026-09-01 | 2026-09-01 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.