September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-97150 When converting baserCMS4-style addons to baserCMS5-style ones,
BcAddonMigrator... |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-92870 A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-92871 A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-92873 Pgpool-II contains an incorrect implementation of an authentication algorithm, w... |
high | 7.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-6806 The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-92867 An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an au... |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-89294 The Simply Schedule Appointments plugin for WordPress is vulnerable to Local Fil... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-91832 The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the non... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-92994 The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not va... |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-89193 The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values t... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-88797 The Vayu X WordPress theme before 1.0.6 does not perform any capability check on... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-85573 The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site'... |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-75823 The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with... |
high | 7.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103111 PCRE2 before 10.49, when there is an attacker-controlled regular expression and... |
high | 7.6 | — | — | 2026-09-30 | 2026-10-04 |
| CVE-2026-102913 A security flaw has been discovered in SourceCodester Car Driving School Managem... |
high | 7.3 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-86134 A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentic... |
high | 7.5 | — | Watchguard / fireware | 2026-09-30 | 2026-10-06 |
| CVE-2026-102910 A security flaw has been discovered in SourceCodester Online Reviewer Management... |
high | 7.3 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-96649 The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin pl... |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103101 Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input valid... |
high | 7.5 | — | Pexip / pexip infinity | 2026-09-30 | 2026-10-05 |
| CVE-2026-103102 Pexip Infinity before 41.0 is affected by improper input validation in the signa... |
high | 8.6 | — | Pexip / pexip infinity | 2026-09-30 | 2026-10-05 |
| CVE-2026-103104 Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper in... |
high | 7.5 | — | Pexip / pexip infinity | 2026-09-30 | 2026-10-05 |
| CVE-2026-103105 Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper ac... |
high | 8.8 | — | Pexip / pexip infinity | 2026-09-30 | 2026-10-05 |
| CVE-2026-103106 Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper i... |
high | 7.8 | — | Pexip / pexip infinity | 2026-09-30 | 2026-10-05 |
| CVE-2026-103108 Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper i... |
high | 7.5 | — | Pexip / pexip infinity | 2026-09-30 | 2026-10-05 |
| CVE-2026-102908 A vulnerability was determined in SourceCodester Online Reviewer Management Syst... |
high | 7.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102909 A vulnerability was identified in SourceCodester Online Reviewer Management Syst... |
high | 7.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103099 Pexip Infinity before 41.1 is affected by improper input validation in the media... |
high | 7.5 | — | Pexip / pexip infinity | 2026-09-30 | 2026-10-06 |
| CVE-2026-103100 Pexip Infinity before 40.1 is affected by improper input validation in the signa... |
high | 7.5 | — | Pexip / pexip infinity | 2026-09-30 | 2026-10-05 |
| CVE-2026-102874 A vulnerability was identified in HKUDS AnyTool 0.1.0. |
high | 7.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103088 Handlebars.java before 4.5.5 allows directory traversal. |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103054 AiSOC versions before 12.0.0 contain an authorization bypass vulnerability in th... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103055 AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verificatio... |
high | 7.5 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-86133 An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (ike... |
high | 7.5 | — | Watchguard / fireware | 2026-09-30 | 2026-10-06 |
| CVE-2026-86136 A missing authorization vulnerability in the wgagent management daemon's session... |
high | 8.1 | — | Watchguard / fireware | 2026-09-30 | 2026-10-06 |
| CVE-2026-90441 A missing authorization vulnerability in the wgagent management daemon's session... |
high | 8.1 | — | Watchguard / fireware | 2026-09-30 | 2026-10-06 |
| CVE-2026-18145 A stack-based buffer overflow vulnerability in the spamBlocker (spamd) service o... |
high | 7.2 | — | Watchguard / fireware | 2026-09-30 | 2026-10-08 |
| CVE-2026-86104 An uncontrolled resource consumption vulnerability in the Fireware OS login proc... |
high | 7.5 | — | Watchguard / fireware | 2026-09-30 | 2026-10-06 |
| CVE-2026-86105 An improper authorization vulnerability in Fireware OS's Access Portal reverse p... |
high | 7.1 | — | Watchguard / fireware | 2026-09-30 | 2026-10-06 |
| CVE-2026-86128 A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-process... |
high | 7.5 | — | Watchguard / fireware | 2026-09-30 | 2026-10-06 |
| CVE-2026-86132 An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (i... |
high | 7.5 | — | Watchguard / fireware | 2026-09-30 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.