September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-18870 IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31,... |
medium | 4.3 | — | Ibm / power system s1122 \(9824-22a\) firmware | 2026-09-24 | 2026-09-30 |
| CVE-2026-92001 Improper restriction of recursive entity references in DTDs ('XML entity expansi... |
medium | 6.1 | — | Apache / sling xss protection api | 2026-09-23 | 2026-09-30 |
| CVE-2026-102313 Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 154.0.80... |
medium | 4.7 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102314 UI misrepresentation in TabStrip in Google Chrome prior to 154.0.8037.92 allowed... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102318 Out of bounds read in WebGL in Google Chrome prior to 154.0.8037.92 allowed a re... |
medium | 4.7 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-73581 Improper Check for Certificate Revocation vulnerability in Apache Tomcat. |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-102771 A security vulnerability has been detected in Naichen ThinkCMF up to 8.0.7. |
medium | 4.7 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-101087 Nezha versions 2.0.10 through 2.3.2 use a restricted HTTP client to validate use... |
medium | 4.3 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100674 stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization... |
medium | 4.3 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-95279 UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.80... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95332 Use of uninitialized variable in Tint in Google Chrome on on Android prior to 15... |
medium | 4.7 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95337 UI misrepresentation in Messages in Google Chrome on on Android prior to 154.0.8... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95321 UI misrepresentation in Payments in Google Chrome on on Android prior to 154.0.8... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102325 Uninitialized resource in Skia in Google Chrome prior to 154.0.8037.92 allowed a... |
medium | 4.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95328 Confused deputy in Mobile in Google Chrome on on Android prior to 154.0.8037.57... |
medium | 6.5 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-97292 Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2.15.0 vers... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97298 Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 v... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97299 Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment Links for... |
medium | 5.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97279 Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions. |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97282 Unauthenticated Insecure Direct Object References (IDOR) in Review Schema <= 3.1... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97285 Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions. |
medium | 5.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97288 Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions. |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97249 Unauthenticated Bypass Vulnerability in Paid Member Subscriptions <= 3.0.9 versi... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97261 Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions. |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97262 Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97266 Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97267 Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 vers... |
medium | 4.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97270 Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0 versions. |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97242 Author Arbitrary File Deletion in WEBO MCP <= 3.0.18 versions. |
medium | 6.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97243 Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions. |
medium | 5.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97247 Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions. |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97079 Subscriber Insecure Direct Object References (IDOR) in Webba Booking <= 6.5.0 ve... |
medium | 4.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97236 Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions. |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97238 Subscriber Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions. |
medium | 5.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97239 Subscriber Broken Access Control in MCP Content Manager Lite <= 1.1.0 versions. |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97066 Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 ver... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97067 Contributor Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.7 versions... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97074 Subscriber Insecure Direct Object References (IDOR) in Newsletters, Email Market... |
medium | 4.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97078 Unauthenticated Insecure Direct Object References (IDOR) in Client Invoicing by... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96829 Contributor Cross Site Scripting (XSS) in The Plus Addons for Elementor Page Bui... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.