September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-96834 Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions. |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96835 Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.85 v... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96821 Subscriber Privilege Escalation in FluentBoards <= 2.0.12 versions. |
medium | 6.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96824 Editor Arbitrary File Deletion in Template Kit – Import <= 1.0.16 versions. |
medium | 6.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96825 Subscriber Bypass Vulnerability in All In One WP Security & Firewall <= 5.4.8 ve... |
medium | 4.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96450 Contributor Cross Site Scripting (XSS) in pixfort Core < 4.3.3 versions. |
medium | 5.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96347 Subscriber Insecure Direct Object References (IDOR) in Bookly <= 28.2 versions. |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96338 Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 versions. |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94681 Unauthenticated Denial of Service Attack in WP Store Locator < 3.0.0 versions. |
medium | 5.9 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94672 Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versio... |
medium | 4.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94673 Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appo... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94674 Contributor Cross Site Scripting (XSS) in Pixel Manager for WooCommerce <= 1.69.... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94173 Contributor Insecure Direct Object References (IDOR) in Business Directory <= 6.... |
medium | 5.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94077 Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions. |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94074 Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-62078 Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.1... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-62079 Contributor Cross Site Scripting (XSS) in Qi Addons For Elementor <= 1.11 versio... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-62080 Contributor Cross Site Scripting (XSS) in Happy Addons for Elementor <= 3.23.1 v... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-62081 Contributor Insecure Direct Object References (IDOR) in Flexible PDF Coupons <=... |
medium | 5.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-62083 Subscriber Other Vulnerability Type in Creator LMS <= 1.2.19 versions. |
medium | 5.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-18417 The native BSD-socket layer recorded a pending asynchronous socket error by type... |
medium | 6.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-103114 A vulnerability was identified in OS4ED openSIS-Classic up to 9.3. |
medium | 6.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103117 A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. |
medium | 4.7 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102912 A vulnerability was identified in SourceCodester Online Leave Management System... |
medium | 4.7 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102842 A vulnerability was identified in gedelumbung HospitalManagement up to c2d455437... |
medium | 6.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102845 A security vulnerability has been detected in gedelumbung HospitalManagement up... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102386 Subscriber Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.003 versi... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102399 Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic... |
medium | 5.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102006 In Wind River VxWorks 7 prior to 26.09, specific system call arguments can resul... |
medium | 5.5 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-102384 Author Cross Site Scripting (XSS) in Supreme Modules Lite <= 2.5.63 versions. |
medium | 5.9 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-100508 Unauthenticated Denial of Service Attack in Two Factor <= 0.16.0 versions. |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-100513 Contributor Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102303 Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037... |
medium | 4.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102307 Uninitialized resource in Dawn in Google Chrome on on Android prior to 154.0.803... |
medium | 4.7 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-94282 An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion in libX... |
medium | 5.6 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-94283 An out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute p... |
medium | 6.5 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-94284 An out-of-bounds read vulnerability in libX11's XIM trigger-key registration par... |
medium | 5.5 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-94285 An out-of-bounds read in libX11's byte-oriented codeset parser in libX11 before... |
medium | 5.1 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-100601 ClawHub (openclaw/clawhub) application/backend contains a server-side request fo... |
medium | 5.3 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100609 Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up... |
medium | 6.8 | — | — | 2026-09-26 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.