September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86334 Path traversal in the CLI client image export and copy functionality in Canonica... |
medium | 4.2 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-15952 Incorrect Permission Assignment for Critical Resource vulnerability in ABB Prote... |
medium | 6.4 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100695 Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CON... |
medium | 6.1 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100595 OpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability... |
medium | 6.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100675 stoatchat versions before 0.15.5 contain a denial of service vulnerability in th... |
medium | 6.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100571 OpenClaw (npm package 'openclaw') versions >= 2026.6.6 and < 2026.8.1 apply the... |
medium | 5.3 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100591 OpenClaw is an npm-distributed agent gateway. |
medium | 6.3 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100538 OpenClaw (npm package 'openclaw') before 2026.8.1 does not apply the originating... |
medium | 6.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100546 OpenClaw (npm package `openclaw`) versions >= 2026.7.2 and < 2026.9.2 contain a... |
medium | 6.4 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100550 OpenClaw (npm package 'openclaw') before 2026.8.1 contains an access-control byp... |
medium | 5.4 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100554 OpenClaw (npm package 'openclaw') versions >= 2026.5.12 and < 2026.8.1 do not im... |
medium | 4.2 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100562 OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability... |
medium | 5.4 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100522 Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in... |
medium | 6.1 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-96273 Ghidra before 12.1.4 fails to validate the TYPE_COL byte in OptionsDB.createUnre... |
medium | 5.5 | — | — | 2026-09-23 | 2026-09-28 |
| CVE-2026-86335 Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, a... |
medium | 6.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-87798 Improper link resolution in the recursive file pull feature of the LXD CLI clien... |
medium | 5.8 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-81882 radare2 is a UNIX-like reverse engineering framework and command-line toolset. |
medium | 6.1 | — | Radare / radare2 | 2026-09-22 | 2026-09-28 |
| CVE-2026-70413 Dell Live Optics Collector, versions prior to 27.2.13.310, contain(s) a Use of H... |
medium | 5.6 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-80358 Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contai... |
medium | 5.1 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-15953 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
medium | 5.0 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100696 Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Fo... |
medium | 5.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100668 Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. |
medium | 6.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-19708 The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated... |
medium | 5.9 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-84097 The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a val... |
medium | 6.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-89237 The Bluff Post WordPress plugin through 1.1.1 does not sanitise and escape param... |
medium | 6.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-92411 The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the... |
medium | 6.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-82841 The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, Up... |
medium | 5.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-84069 The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of it... |
medium | 5.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-85002 The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block at... |
medium | 6.8 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-86841 The Online Scheduling and Appointment Booking System WordPress plugin before 28.... |
medium | 4.7 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-89000 The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a... |
medium | 4.1 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-89001 The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not verify th... |
medium | 4.9 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-89003 The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a... |
medium | 4.1 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-89006 The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize... |
medium | 6.8 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-92436 The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authe... |
medium | 5.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-92995 The Verge3D Publishing and E-Commerce WordPress plugin through 4.13.0 does not r... |
medium | 5.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-84744 The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcod... |
medium | 6.5 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-86838 The Bookly WordPress plugin before 28.3 does not validate client-supplied bookin... |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-88828 The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does... |
medium | 5.4 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-89300 The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation... |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.