September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-93974 A flaw has been found in SourceCodester Online Reviewer Management System 1.0. |
high | 7.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-93970 A security flaw has been discovered in aiyiyi121 SxDevOps 1.0/1.1. |
high | 7.3 | — | — | 2026-09-20 | 2026-09-23 |
| CVE-2026-93972 A security vulnerability has been detected in SourceCodester Online Reviewer Man... |
high | 7.3 | — | — | 2026-09-20 | 2026-09-24 |
| CVE-2026-93969 A vulnerability was identified in aiyiyi121 SxDevOps 1.0/1.1. |
high | 7.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-92540 The Import and export users and customers WordPress plugin before 2.5.2 does not... |
high | 7.2 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-92541 The Import and export users and customers WordPress plugin before 2.5.2 does not... |
high | 7.2 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-82842 The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the config... |
high | 8.1 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-85017 The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not per... |
high | 7.5 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-87067 The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which cl... |
high | 8.5 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-87839 The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, an... |
high | 7.5 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-81650 The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not... |
high | 7.2 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-93962 A weakness has been identified in Kamailio up to 5.8.8/6.0.7/6.1.4/6.2.0-dev1. |
high | 8.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-86553 SmartLife app dynamically generates fresh SmartLife application authentication p... |
high | 8.8 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-93959 A vulnerability was determined in SourceCodester Online Reviewer Management Syst... |
high | 7.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-94056 Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled pro... |
high | 7.5 | — | Exim / exim | 2026-09-19 | 2026-09-24 |
| CVE-2026-93990 Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is fo... |
high | 7.5 | — | — | 2026-09-19 | 2026-09-28 |
| CVE-2026-93991 Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vuln... |
high | 7.7 | — | — | 2026-09-19 | 2026-09-22 |
| CVE-2026-93992 Gopeed through 2.0.0-beta.3 contains a path traversal vulnerability in archive e... |
high | 8.1 | — | — | 2026-09-19 | 2026-09-22 |
| CVE-2026-93993 Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the... |
high | 8.8 | — | — | 2026-09-19 | 2026-09-22 |
| CVE-2026-82560 Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatt... |
high | 7.5 | — | — | 2026-09-19 | 2026-09-22 |
| CVE-2026-1255 The YS LeadGen plugin for WordPress is vulnerable to Sensitive Information Expos... |
high | 7.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-85658 The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User... |
high | 8.1 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-4327 The The Welcomizer plugin for WordPress is vulnerable to Remote Code Execution i... |
high | 8.8 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-15664 The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for... |
high | 7.2 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-86814 The UsersWP WordPress plugin before 1.5.10 does not verify that a social login p... |
high | 8.1 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-88824 The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on o... |
high | 8.8 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-88926 The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4... |
high | 8.6 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-92404 The MgoSync WordPress plugin before 2.1.7 does not have authorization controls o... |
high | 7.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-76554 The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that th... |
high | 7.2 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-76790 The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise a... |
high | 7.1 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-85574 The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any au... |
high | 8.0 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-85680 The Ultimate Member WordPress plugin before 2.13.1 does not escape a value deriv... |
high | 8.8 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-92807 The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Arbitra... |
high | 8.8 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-87909 The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execut... |
high | 7.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-13354 The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Stor... |
high | 7.2 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-93922 SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker... |
high | 8.8 | — | — | 2026-09-19 | 2026-09-22 |
| CVE-2026-93923 SiYuan through 3.8.4 fails to escape heading style attributes when rendering out... |
high | 8.8 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-88097 Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacke... |
high | 7.8 | — | Microsoft / edge chromium | 2026-09-18 | 2026-09-24 |
| CVE-2026-71418 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-18 | 2026-09-28 |
| CVE-2026-71855 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-18 | 2026-09-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.