September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84773 Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.6 vers... |
high | 7.2 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84777 Unauthenticated Broken Authentication in Really Simple SSL <= 9.8.0 versions. |
high | 7.4 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84779 Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Ag... |
high | 8.1 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84765 Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT <= 7.5.1 versions... |
high | 7.1 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84757 Unauthenticated Settings Change in WP Compress <= 7.21.28 versions. |
high | 8.2 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84752 Contributor PHP Object Injection in RTMKit <= 2.1.5 versions. |
high | 8.8 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-81300 Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 <=... |
high | 7.1 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-81292 Unauthenticated Cross Site Scripting (XSS) in Simple Payment <= 2.5.1 versions. |
high | 7.1 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2021-38489 HDD password plaintext is stored in a UEFI variable. |
high | 8.2 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-19116 The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-19453 The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capab... |
high | 7.1 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-19723 The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.... |
high | 7.1 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-77792 The RegistrationMagic WordPress plugin before 6.0.9.9 does not escape a registra... |
high | 7.5 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-80467 The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not re... |
high | 8.1 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81737 The FAQ Builder AYS WordPress plugin before 1.8.5 does not sanitize or escape co... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81807 The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat messa... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-82183 The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the ident... |
high | 8.1 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-12526 The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not ve... |
high | 8.1 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-12865 The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two re... |
high | 7.1 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84350 Use after free in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84351 Buffer overflow in GPU in Google Chrome on on Windows prior to 152.0.7977.75 all... |
high | 8.3 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-85105 A flaw has been found in NousResearch hermes-agent 0.18.0. |
high | 7.3 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-85110 A vulnerability was identified in Tenda HG10 300001138. |
high | 8.8 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-85138 A vulnerability was detected in SeaCMS up to 13.6. |
high | 7.3 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84347 Use after free in WebRTC in Google Chrome prior to 152.0.7977.75 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-51788 An issue in cleverange_auth v.0.1.10 allows a remote attacker to cause a denial... |
high | 7.5 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-84349 Use after free in Browser in Google Chrome prior to 152.0.7977.75 allowed a remo... |
high | 8.3 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84647 In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, inc... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84649 In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), e... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84665 Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes f... |
high | 8.0 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84667 Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's back... |
high | 7.1 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84668 Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAM... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84669 A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allow... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84670 Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict th... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84671 Jenkins File Parameter Plugin 425.v3fa_801681b_5e and earlier allows writing fil... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84672 Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9cc2d2 and e... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84673 Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overw... |
high | 8.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84675 OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier a... |
high | 7.4 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84326 Uninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a r... |
high | 8.8 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84334 Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 15... |
high | 8.1 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.