September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-97250 Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97253 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97244 Contributor Path Traversal in Creator LMS <= 1.2.19 versions. |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97245 Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions. |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97235 Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97237 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-09-30 | 2026-10-22 |
| CVE-2026-97240 Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97241 Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions. |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97077 Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.18 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97197 Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 v... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96832 Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions. |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96833 Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 vers... |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96836 Unauthenticated Cross Site Scripting (XSS) in Parsi Date <= 6.3 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96837 Contributor Remote Code Execution (RCE) in CartFlows <= 3.2.0 versions. |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96838 Unauthenticated Cross Site Request Forgery (CSRF) in Blacklist Manager – WooComm... |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97065 Unauthenticated Cross Site Scripting (XSS) in Happyforms <= 1.26.15 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96827 Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions. |
high | 7.6 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96828 Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions. |
high | 7.6 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96830 Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96831 Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions. |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96817 Subscriber Broken Access Control in MakeCommerce for WooCommerce <= 4.1.0 versio... |
high | 8.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96818 Unauthenticated Broken Access Control in WP Express Checkout (Accept PayPal Paym... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96819 Subscriber Cross Site Scripting (XSS) in oik <= 4.15.4 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96820 Subscriber Cross Site Scripting (XSS) in Awesome Support <= 6.3.9 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96823 Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96351 Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 6.1.3 versio... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96352 Unauthenticated Cross Site Scripting (XSS) in YITH WooCommerce Ajax Search <= 2.... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96814 Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <=... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96815 Custom role Privilege Escalation in Vitepos <= 3.5.0 versions. |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96816 Unauthenticated Cross Site Scripting (XSS) in Trusted Shops Easy Integration for... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96343 Custom role PHP Object Injection in WP ERP <= 1.17.9 versions. |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96344 Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions. |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96345 Administrator SQL Injection in Estatik <= 4.3.5 versions. |
high | 7.6 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96346 Author SQL Injection in WP ERP <= 1.17.9 versions. |
high | 7.6 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96348 Unauthenticated Broken Access Control in Bookly <= 28.2 versions. |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-95531 Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 ver... |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-95587 Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions. |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-95616 An integer overflow in WSS4J's DER bounds check lets an oversized allocation pas... |
high | 7.5 | — | Apache / wss4j | 2026-09-30 | 2026-10-06 |
| CVE-2026-94499 Subscriber Broken Access Control in FormGent <= 1.12.2 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94677 Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.1... |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.