September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92564 A pre-authentication attacker could leverage type nesting to cause a StackOverfl... |
high | 7.5 | — | Apache / qpid broker-j | 2026-09-25 | 2026-10-05 |
| CVE-2026-94573 The Repeater Fields for Elementor Forms plugin for WordPress is vulnerable to St... |
high | 7.2 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-95864 The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
high | 7.2 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-95866 The User Profile Builder – Beautiful User Registration Forms, User Profiles & Us... |
high | 7.2 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-96568 The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stor... |
high | 7.2 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-96752 The Zero Spam for WordPress plugin for WordPress is vulnerable to Stored Cross-S... |
high | 7.2 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-92608 Improper handling of property-encoding exceptions in AMQP 1.0-to-AMQP 0-10 messa... |
high | 7.5 | — | Apache / qpid broker-j | 2026-09-25 | 2026-10-05 |
| CVE-2026-92713 The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vu... |
high | 8.1 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-93654 The Premium Packages – Sell Digital Products Securely plugin for WordPress is vu... |
high | 7.2 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-93901 The Optima Express IDX plugin for WordPress is vulnerable to Privilege Escalatio... |
high | 7.3 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-19804 The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywa... |
high | 8.8 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-84280 The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Si... |
high | 7.2 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-89406 The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vu... |
high | 7.5 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-89426 The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPre... |
high | 8.8 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-13456 The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory &... |
high | 7.5 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-96039 The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site S... |
high | 7.2 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-84281 The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Si... |
high | 7.2 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-93303 The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPres... |
high | 7.2 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-62062 Cross-Site Request Forgery (CSRF) vulnerability in Elementor Website Builder all... |
high | 8.8 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-83591 The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to... |
high | 7.2 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-84279 The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Si... |
high | 7.2 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-97818 phpIPAM through 1.8.3 has incorrect authorization for id=="admins" and id=="all"... |
high | 8.6 | — | — | 2026-09-25 | 2026-10-06 |
| CVE-2026-97737 In Wakapi before 2.17.6, the user caching service allows a lookup to be resolved... |
high | 7.4 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-97735 ITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/tick... |
high | 8.0 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-97730 In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File I... |
high | 8.5 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-97731 MinIO through 7aac2a2 does not verify that every x-amz-* header present on a req... |
high | 7.1 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-97646 A weakness has been identified in ningzichun student-management-system up to 987... |
high | 7.3 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-85491 Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path... |
high | 8.8 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-88388 Espruino 2v29 (commit bffc6d0) contains a stack-based buffer overflow vulnerabil... |
high | 7.5 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-81630 The Botslab G980H dash camera firmware does not adequately verify the authentici... |
high | 8.1 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-96883 pgcollection is an open source extension to PostgreSQL. |
high | 8.8 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-97324 A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.... |
high | 7.3 | — | — | 2026-09-24 | 2026-10-05 |
| CVE-2026-97326 A weakness has been identified in songxinjianqwe Chat up to ac63d25297079eed5e4b... |
high | 7.3 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-93289 The affected products are vulnerable to command injection attack that could allo... |
high | 7.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-93354 Taskview Community before 1.56.0 contains a missing authentication vulnerability... |
high | 8.1 | — | — | 2026-09-24 | 2026-10-05 |
| CVE-2026-82164 Dell Trusted Device Client, versions prior to 8.1.359.0, contain an Incorrect Pe... |
high | 7.1 | — | — | 2026-09-24 | 2026-09-26 |
| CVE-2026-82566 The Botslab G980H dash camera firmware contains a session management vulnerabili... |
high | 8.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-84399 The Botslab G980H dash camera firmware contains an authorization vulnerability i... |
high | 8.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-85496 The Botslab G980H dash camera firmware generates session identifiers using a sma... |
high | 8.8 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-77967 The Botslab G980H dash camera firmware accepts a reusable authentication value w... |
high | 8.1 | — | — | 2026-09-24 | 2026-09-25 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.