September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-93494 A flaw was found in Netty's StompSubframeDecoder component. |
high | 7.5 | — | — | 2026-09-18 | 2026-09-25 |
| CVE-2026-75157 Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-a... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-85705 The Location Manager plugin for WordPress is vulnerable to generic SQL Injection... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-89058 A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all o... |
high | 7.4 | — | — | 2026-09-18 | 2026-10-29 |
| CVE-2026-89059 A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied... |
high | 7.5 | — | — | 2026-09-18 | 2026-10-29 |
| CVE-2026-18442 The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPr... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-67102 HCL BigFix Service Management is affected by a high-severity Broken Access Contr... |
high | 8.1 | — | Hcltech / bigfix service management | 2026-09-18 | 2026-10-08 |
| CVE-2026-12954 The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Wr... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-14323 The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-15275 The WP Multi Store Locator Pro plugin for WordPress is vulnerable to generic SQL... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-19 |
| CVE-2026-12384 Authorization bypass through User-Controlled key vulnerability in TECHIN2B TECHI... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-89413 The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in... |
high | 8.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-92619 The Booking Calendar plugin for WordPress is vulnerable to Privilege Escalation... |
high | 7.2 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-88825 The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-90978 The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on se... |
high | 7.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-93485 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-09-18 | 2026-10-17 |
| CVE-2026-85127 The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does no... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-87767 The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does... |
high | 8.6 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-87770 The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sani... |
high | 8.6 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-87771 The Product Question and Answer WordPress plugin through 1.1.0 does not sanitize... |
high | 8.6 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-87774 The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize an... |
high | 8.6 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-87775 The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize an... |
high | 8.6 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-81810 The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not pe... |
high | 7.2 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-85122 The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not vali... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-18912 ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authent... |
high | 7.7 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-18911 ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent a... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-17086 The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-93371 A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up t... |
high | 8.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93468 The OAKlouds developed by HGiga has an Arbitrary File Read vulnerability. |
high | 7.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-93456 django-page-cms through 2.0.13 exempts five admin mutation views from CSRF prote... |
high | 8.2 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93331 A vulnerability was identified in GPAC 26.08-DEV. |
high | 7.3 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-93450 go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93452 snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in Snappy.... |
high | 7.5 | — | — | 2026-09-18 | 2026-10-08 |
| CVE-2026-93453 SOGo before 5.12.11 constructs password-reset links using the client-supplied Or... |
high | 8.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-85887 Incorrect permission assignment for critical resource in M365 Copilot allows an... |
high | 7.7 | — | Microsoft / 365 copilot | 2026-09-18 | 2026-09-28 |
| CVE-2026-93435 redis-parser through 3.0.0 contains a denial of service vulnerability in the RES... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-28 |
| CVE-2026-93436 vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected... |
high | 7.5 | — | Vllm / vllm | 2026-09-17 | 2026-09-28 |
| CVE-2026-87886 Acronis Backup Incorrect Default Permissions Vulnerability |
high | 7.8 | Listed | Acronis / Backup | 2026-09-17 | 2026-09-18 |
| CVE-2026-85885 Improper neutralization of special elements used in a command ('command injectio... |
high | 8.8 | — | Microsoft / 365 copilot | 2026-09-17 | 2026-09-25 |
| CVE-2026-85917 Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized at... |
high | 7.5 | — | Microsoft / foundry | 2026-09-17 | 2026-09-25 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.