September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-80491 The SAMO Forms WordPress plugin through 1.0.0 does not properly sanitise and esc... |
high | 8.6 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-80494 The Yogeta WP Cloud WordPress plugin through 1.0 does not validate a user-suppli... |
high | 8.6 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-81090 The Gpx2Graphics WordPress plugin through 0.3 does not perform a CSRF check when... |
high | 7.2 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-81429 The Export & Import WPBakery Page Builder WordPress plugin through 1.0.2 does no... |
high | 7.1 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-81742 The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any author... |
high | 8.8 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-84047 The Album Cover Finder WordPress plugin through 0.7.0 does not properly sanitize... |
high | 8.6 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-84099 The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthen... |
high | 8.1 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-87759 The Add User Autocomplete WordPress plugin before 1.2 does not perform any capab... |
high | 8.8 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-87842 The Zonify WordPress plugin before 1.0.5 does not perform any capability or auth... |
high | 7.5 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-87888 The YayPricing WordPress plugin before 3.5.7 does not perform an authorization c... |
high | 8.0 | — | — | 2026-09-12 | 2026-09-14 |
| CVE-2026-80071 The User Registration & Membership WordPress plugin before 5.2.8 does not proper... |
high | 7.2 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-86406 The User Registration & Membership WordPress plugin before 5.2.8 does not check... |
high | 7.5 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-89080 The Really Simple Security WordPress plugin before 9.8.1 does not prevent an una... |
high | 7.5 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-74933 The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisatio... |
high | 8.8 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-85129 The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or vali... |
high | 8.8 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-88793 The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any author... |
high | 8.8 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-88802 The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events... |
high | 7.5 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-89023 ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missin... |
high | 8.6 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-72524 Incorrect Authorization vulnerability in Apache Doris allows an authenticated us... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-87779 Insertion of sensitive information into log file vulnerability in Apache Syncope... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-73178 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apac... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-78336 Insertion of sensitive information into sent data vulnerability in Apache Syncop... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-73195 Improper Encoding or Escaping of Output vulnerability in Apache Syncope. |
high | 7.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-73236 Incorrect Authorization vulnerability in Apache Syncope. |
high | 7.5 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-82427 Description
A topology's `topology.blobstore.map` lets the submitter choose a l... |
high | 7.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-82428 Description
Dependency artifacts uploaded with `storm jar --artifacts` were sto... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-82429 Description
The setuid-root `worker-launcher` binary adjusts ownership and perm... |
high | 7.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-82430 Description
When launching a Docker or OCI worker, the setuid-root `worker-laun... |
high | 7.8 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-82432 Description
Nimbus validated `topology.blobstore.map` against the calling subje... |
high | 8.1 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-82438 Description
Three separate mechanisms allowed a web page on an unrelated origin... |
high | 8.1 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90495 A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. |
high | 7.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90510 A security vulnerability has been detected in dromara orion-visor up to 2.5.7. |
high | 8.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90516 A vulnerability was found in SourceCodester School Registration and Fee System 1... |
high | 7.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90523 A vulnerability was identified in jaychouchannel Tourism-Management-System up to... |
high | 7.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90526 A security vulnerability has been detected in SourceCodester School Registration... |
high | 7.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90566 A weakness has been identified in Rizwan17 inventory-management-system up to bfe... |
high | 7.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90579 A vulnerability has been found in cheshire-cat-ai Cheshire Cat AI up to 1.9.2. |
high | 7.3 | — | — | 2026-09-13 | 2026-09-14 |
| CVE-2026-90618 A flaw has been found in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd11... |
high | 7.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90620 A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c... |
high | 7.3 | — | — | 2026-09-14 | 2026-09-14 |
| CVE-2026-90689 A security flaw has been discovered in Tenda W20E 15.11.0.61068_1546_841_CN_TDC. |
high | 8.8 | — | — | 2026-09-14 | 2026-09-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.