September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-89303 The Post Voting System WordPress plugin through 1.0 does not properly sanitize a... |
medium | 6.4 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-89411 The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a... |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-92996 The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the... |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-93000 The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query... |
medium | 6.8 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100237 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-63432 Horilla is an HR and CRM software. |
medium | 6.5 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-72662 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to... |
medium | 6.3 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-78582 Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of d... |
medium | 6.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-18311 Readwise Reader for Android contains a cross-site scripting vulnerability due to... |
medium | 6.1 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-18312 Readwise Reader for Android constructs URLs in its WebView using attacker-contro... |
medium | 6.1 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-18320 Readwise Reader for Android uses a sanitize-html configuration that permits all... |
medium | 6.1 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-80359 Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contai... |
medium | 6.8 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-94387 Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in... |
medium | 5.4 | — | — | 2026-09-21 | 2026-09-28 |
| CVE-2026-91119 Discourse is an open-source discussion platform. |
medium | 6.4 | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-79760 Termix is a web-based server management platform with SSH terminal, tunneling, a... |
medium | 6.4 | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-79762 Termix is a web-based server management platform with SSH terminal, tunneling, a... |
medium | 5.5 | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-100745 A vulnerability has been found in Edimax BR-6428nC 1.16. |
medium | 6.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100836 Contrast through 1.20.0 contains a panic vulnerability in the transit-engine end... |
medium | 4.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-101071 A vulnerability was determined in Acrel Electric Unet Web Service up to 20260814... |
medium | 6.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-21098 Improper access control in Link to Windows prior to SMR Sep-2026 Release 1 allow... |
medium | 6.1 | — | Samsung / android | 2026-09-09 | 2026-09-28 |
| CVE-2026-92874 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3... |
medium | 5.4 | — | Gitlab / gitlab | 2026-09-24 | 2026-09-28 |
| CVE-2026-19619 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0... |
medium | 4.7 | — | Gitlab / gitlab | 2026-09-16 | 2026-09-28 |
| CVE-2026-16794 GitLab has remediated an issue in GitLab EE affecting all versions from 18.11 be... |
medium | 4.3 | — | Gitlab / gitlab | 2026-09-16 | 2026-09-28 |
| CVE-2024-11222 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0... |
medium | 6.4 | — | Gitlab / gitlab | 2026-09-16 | 2026-09-28 |
| CVE-2026-83459 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: hel... |
medium | 5.3 | — | Oracle / helidon | 2026-09-15 | 2026-09-28 |
| CVE-2026-83458 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: JSO... |
medium | 5.3 | — | Oracle / helidon | 2026-09-15 | 2026-09-28 |
| CVE-2026-96895 The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attribut... |
medium | 6.8 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-96897 The Optima Express IDX WordPress plugin before 8.7.6 does not perform any author... |
medium | 5.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-96899 The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralis... |
medium | 6.8 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-97227 The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does... |
medium | 5.9 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-97319 The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.2 does... |
medium | 6.8 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-85738 TREK is a collaborative travel planner. |
medium | 6.3 | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-54790 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
medium | 6.0 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-59563 Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation... |
medium | 4.6 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101069 A weakness has been identified in dbgate up to 7.3.1. |
medium | 6.5 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100712 froxlor through 2.3.10 disables a user's two-factor authentication immediately u... |
medium | 6.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-96531 The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attribu... |
medium | 6.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-96533 The Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-... |
medium | 5.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-97864 A vulnerability has been found in GibbonEdu Gibbon up to 30.0.01. |
medium | 5.3 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-97866 A weakness has been identified in Zhonglun CloudPOS 3.0. |
medium | 5.6 | — | — | 2026-09-25 | 2026-09-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.