September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-55179 Joplin is an open source note-taking and to-do application that organises notes... |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-59816 Joplin is an open source note-taking and to-do application that organises notes... |
medium | 4.3 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-61722 FluidSynth is a software synthesizer based on the SoundFont 2 specifications. |
medium | 6.8 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-76805 Nuclei is a vulnerability scanner built on a simple YAML-based DSL. |
medium | 5.3 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-83600 Netdata is an open source observability tool. |
medium | 6.5 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-86056 Notepad++ is a free and open-source source code editor. |
medium | 5.5 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-63334 draw.io is a configurable diagramming and whiteboarding application. |
medium | 6.8 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-63373 draw.io is a configurable diagramming and whiteboarding application. |
medium | 4.2 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-93307 A vulnerability has been found in O-RAN-SC SMO OAM 2025-06-10. |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-78579 The Okta Access Gateway does not sanitize SAML assertion attribute values before... |
medium | 6.5 | — | Okta / access gateway | 2026-09-08 | 2026-09-23 |
| CVE-2026-16264 The Newsletters WordPress plugin before 4.18.1 does not perform an ownership che... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-18364 The zportals WordPress plugin before 6.4.2 does not perform any capability or no... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-18365 The zportals WordPress plugin before 6.4.2 does not perform any capability or no... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-77765 The Better Payment WordPress plugin before 2.3.4 does not validate the submitted... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-77766 The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPr... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-80342 The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.27 does n... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-81338 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not pro... |
medium | 4.6 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-81339 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not per... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-83555 The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not veri... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-84026 The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPr... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-84027 The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPr... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-84046 The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPr... |
medium | 5.0 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-84098 The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPr... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-84150 The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPr... |
medium | 5.4 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-84168 The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidde... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-84741 The Events Calendar WordPress plugin before 6.17.5 does not check the post statu... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-85006 The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an... |
medium | 6.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-86602 The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capabili... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-86603 The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisati... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-86783 The Post Grid Gutenberg Blocks WordPress plugin before 5.0.41 does not perform a... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-86842 The Real3D Flipbook WordPress plugin before 5.4 does not perform capability chec... |
medium | 6.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-86601 The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes fr... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-86604 The GTranslate WordPress plugin before 5.0.1 does not remove shortcodes from the... |
medium | 4.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-86612 The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expa... |
medium | 5.6 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-87070 The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a req... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-87071 The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which me... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-87978 The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the re... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-78574 The Okta Hyperdrive Integration plugin resolves a required assembly using a regi... |
medium | 6.3 | — | Okta / hyperdrive | 2026-09-08 | 2026-09-23 |
| CVE-2026-86785 The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-87979 The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the re... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.