September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-7298 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | — | 2026-09-11 | 2026-09-25 |
| CVE-2026-79306 CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-25 |
| CVE-2026-48496 OpenTelemetry eBPF Profiler is a production-scale agent for profiling applicatio... |
medium | 6.2 | — | — | 2026-09-11 | 2026-09-25 |
| CVE-2026-47256 OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability... |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-25 |
| CVE-2026-47215 SingularityCE and SingularityPRO are open source container platforms. |
medium | 4.8 | — | — | 2026-09-15 | 2026-09-25 |
| CVE-2026-54050 Sakai is a Collaboration and Learning Environment (CLE). |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-25 |
| CVE-2026-97846 Keycloak provides a feature called mTLS holder-of-key binding which ensures that... |
medium | 6.8 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-97368 A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. |
medium | 6.3 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-97650 A vulnerability has been found in ningzichun student-management-system up to 987... |
medium | 4.3 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-93897 The GeoDirectory – WP Business Directory Plugin and Classified Listings Director... |
medium | 6.4 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-93899 The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots pl... |
medium | 6.5 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-94376 The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots pl... |
medium | 6.4 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-93656 The User Profile Builder – Beautiful User Registration Forms, User Profiles & Us... |
medium | 6.4 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-93747 The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripti... |
medium | 6.4 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-92746 The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPre... |
medium | 6.4 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-92829 The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vuln... |
medium | 4.3 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-92212 The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnera... |
medium | 6.1 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-19775 The OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin plugin f... |
medium | 4.3 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-17602 The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress i... |
medium | 4.9 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-12037 The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Serv... |
medium | 5.5 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-13179 The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory &... |
medium | 6.4 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-53715 Envoy Gateway is an open source project for managing Envoy Proxy as a standalone... |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-25 |
| CVE-2026-53718 Envoy Gateway is an open source project for managing Envoy Proxy as a standalone... |
medium | 6.4 | — | — | 2026-09-14 | 2026-09-25 |
| CVE-2026-48785 Apptainer is an open source container platform. |
medium | 4.8 | — | — | 2026-09-15 | 2026-09-25 |
| CVE-2026-91129 Home Assistant is open source home automation software focused on local control... |
medium | 5.4 | — | — | 2026-09-22 | 2026-09-25 |
| CVE-2026-69449 Heap-based buffer overflow in Windows BitLocker allows an authorized attacker to... |
medium | 6.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-25 |
| CVE-2026-61413 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
medium | 6.8 | — | Dell / policy manager for secure connect gateway | 2026-09-23 | 2026-09-25 |
| CVE-2026-71177 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
medium | 5.4 | — | Dell / policy manager for secure connect gateway | 2026-09-23 | 2026-09-25 |
| CVE-2026-73586 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
medium | 6.4 | — | Dell / policy manager for secure connect gateway | 2026-09-23 | 2026-09-25 |
| CVE-2026-73587 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
medium | 6.8 | — | Dell / policy manager for secure connect gateway | 2026-09-23 | 2026-09-25 |
| CVE-2026-73589 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
medium | 6.3 | — | Dell / policy manager for secure connect gateway | 2026-09-23 | 2026-09-25 |
| CVE-2026-78393 The Link Library WordPress plugin before 7.9.6 does not properly escape some par... |
medium | 6.1 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-78394 The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied... |
medium | 4.1 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-78397 The Link Library WordPress plugin before 7.9.6 does not validate the destination... |
medium | 4.0 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-80514 The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the so... |
medium | 5.3 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-86837 The Bookly WordPress plugin before 28.3 does not properly verify a customer's id... |
medium | 5.3 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-88848 The MasterStudy LMS WordPress plugin from 1.9 before 3.7.50 does not verify that... |
medium | 4.2 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-81508 ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-91867 When Neethi fetches a remote policy reference, it only limits the time per read,... |
medium | 4.3 | — | Apache / neethi | 2026-09-21 | 2026-09-25 |
| CVE-2026-92799 The Online Scheduling and Appointment Booking System – Bookly plugin for WordPre... |
medium | 5.3 | — | — | 2026-09-25 | 2026-09-25 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.