September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-85415 The Audio Player Block WordPress plugin before 1.6.3 does not validate the schem... |
medium | 6.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-85576 The All in One Files Upload WordPress plugin before 2.0.17 does not have any cap... |
medium | 4.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-86789 The Connections Business Directory WordPress plugin through 10.4.67 does not app... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-87777 The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize and escape a... |
medium | 6.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-89190 The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user'... |
medium | 4.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-90953 The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended... |
medium | 4.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-91051 The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenti... |
medium | 6.6 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-91072 The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-d... |
medium | 4.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-92424 The Content Egg WordPress plugin before 11.9.0 does not verify that a user runni... |
medium | 6.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-93580 The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94274 The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96886 The Course Booking System WordPress plugin before 7.0.9 does not restrict access... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-95336 Information leak in Transactions Platform in Google Chrome prior to 154.0.8037.5... |
medium | 6.5 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95346 UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allow... |
medium | 4.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95352 Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allo... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-92712 The ReactPress – Create React App for WordPress plugin for WordPress is vulnerab... |
medium | 6.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-88037 The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Sc... |
medium | 6.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-86157 Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere... |
medium | 5.6 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-86778 Observable response discrepancy vulnerability in Maksisoft Technology, IT, and S... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-6170 The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Sc... |
medium | 6.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-6171 The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Sc... |
medium | 6.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-6172 The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Sc... |
medium | 6.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-6173 The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Sc... |
medium | 6.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-62084 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-14876 The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scrip... |
medium | 6.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-16596 The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-11895 The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin f... |
medium | 6.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-100858 heym before 0.0.109 contains a server-side request forgery vulnerability in the... |
medium | 6.8 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100859 Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST... |
medium | 6.5 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100862 heym, a workflow automation platform, stores and returns multiple capability sec... |
medium | 4.9 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100863 Heym versions 0.0.90 and earlier contain two server-side request forgery (SSRF)... |
medium | 5.0 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100678 stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA log... |
medium | 6.5 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100694 Hugo is a static site generator. |
medium | 6.1 | — | Gohugo / hugo | 2026-09-26 | 2026-09-30 |
| CVE-2026-100698 Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the h... |
medium | 5.8 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-73192 An improper neutralization of input during web page generation ('Cross-site Scri... |
medium | 6.1 | — | Apache / sling xss protection api | 2026-09-23 | 2026-09-30 |
| CVE-2026-91852 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Apache / sling xss protection api | 2026-09-23 | 2026-09-30 |
| CVE-2026-93995 Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-93996 Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versi... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-91928 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Apache / sling xss protection api | 2026-09-23 | 2026-09-30 |
| CVE-2026-91999 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Apache / sling xss protection api | 2026-09-23 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.