September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-94678 Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions. |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94683 Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions. |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94123 Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions. |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94177 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-09-30 | 2026-10-17 |
| CVE-2026-94178 Subscriber Privilege Escalation in Import and export users and customers <= 2.5.... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94082 Author SQL Injection in Quiz Cat <= 3.1.1 versions. |
high | 7.6 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94115 Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions. |
high | 8.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94120 Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <=... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94121 Contributor PHP Object Injection in 10Web Booster – Website speed optimization,... |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94122 Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions. |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94076 Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 version... |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94078 Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94081 Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-93514 Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5.2... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-93621 Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions. |
high | 8.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-93624 Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versi... |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-93651 Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2... |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-93770 Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-93771 Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 vers... |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-92121 In the WSS4J streaming (StAX) code, a signature reference using the WS-Security... |
high | 7.5 | — | Apache / wss4j | 2026-09-30 | 2026-10-06 |
| CVE-2026-93512 Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-62085 Administrator SQL Injection in WP Activity Log <= 5.6.6 versions. |
high | 7.6 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-27371 Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102385 Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102395 Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps <= 1.14.6 version... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102396 Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic <= 1.5.... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102398 Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versi... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-100507 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-09-30 | 2026-10-07 |
| CVE-2026-62146 A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influ... |
high | 7.8 | — | — | 2026-09-30 | 2026-10-27 |
| CVE-2026-85532 Apache WSS4J accepted attacker-controlled derived-key lengths and offsets withou... |
high | 7.5 | — | Apache / wss4j | 2026-09-30 | 2026-10-02 |
| CVE-2026-103242 A heap-based buffer overflow flaw was found in rpm. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-76992 The CODESYS Gateway Client allocates memory based on a size field in a gateway r... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-79625 Affected products do not properly synchronize access to their monitoring functio... |
high | 8.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-93994 Apache MINA SSHD is a Java library for client-side and server-side SSH. |
high | 8.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94002 Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-10764 Information disclosure in BVMS 4.5 up to 12.3 including allows man-in-the-middle... |
high | 8.7 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-75098 The Product Designer App plugin for WordPress is vulnerable to Directory Travers... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97347 The Post Views Stats Counter plugin for WordPress is vulnerable to Stored Cross-... |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102578 A flaw was found in Moodle. |
high | 8.8 | — | Moodle / moodle | 2026-09-30 | 2026-10-01 |
| CVE-2026-102454 EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.