September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87981 The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a cap... |
medium | 4.7 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-88929 The Product Badge, Label, Countdown Timer for WooCommerce WordPress plugin befor... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-88997 The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escap... |
medium | 6.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-89331 The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the me... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-90985 The WPC Smart Compare for WooCommerce WordPress plugin before 6.6.1 does not app... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-91024 The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape... |
medium | 6.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-91025 The Booking Manager WordPress plugin before 2.1.21 does not verify that a reques... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-91073 The Subscribe Forms WordPress plugin before 1.6.3 does not sanitise and escape o... |
medium | 6.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93510 The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not v... |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93511 The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webh... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-90950 The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-64684 RMCP is an official Rust SDK for the Model Context Protocol. |
medium | 6.8 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-75523 Steeltoe is an open source project that provides a collection of libraries that... |
medium | 5.9 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-85999 Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-54521 FairEmail is a fully featured, open source, privacy-friendly email app for Andro... |
medium | 6.1 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-54907 Caddy Proxy Manager is a web interface for managing Caddy Server reverse proxies... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-54644 CubeCart is an ecommerce software solution. |
medium | 6.1 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-77607 Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-69186 c-ares is an asynchronous resolver library. |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-77385 Kyoo is a self-hosted media server focused on movies, series, and anime. |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-77399 icalendar is an RFC 5545 compatible parser and generator of iCalendar files for... |
medium | 6.5 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-65829 MPXJ is an open source library to read and write project plans from a variety of... |
medium | 5.3 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-79767 Gardener implements the automated management and operation of Kubernetes cluster... |
medium | 5.5 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-83801 Nautobot is a Network Source of Truth and Network Automation Platform. |
medium | 5.4 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-77425 Unleash is an open-source feature management platform. |
medium | 4.3 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-73858 Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building too... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-88974 WPGraphQL provides a GraphQL API for WordPress sites. |
medium | 5.4 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-78560 The Okta Access Gateway includes an optional pass-through authentication source... |
medium | 6.5 | — | Okta / access gateway | 2026-09-08 | 2026-09-23 |
| CVE-2026-96443 Insufficient validation of the JDBC driver URL in Apache Doris allows a privileg... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-80444 URL redirection to untrusted site ('open redirect') vulnerability in Abis Techno... |
medium | 5.4 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-77112 Server-Side request forgery (SSRF) vulnerability in Global IT Informatics Techno... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-87252 Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component:... |
medium | 6.8 | — | Oracle / agile product lifecycle management | 2026-09-15 | 2026-09-23 |
| CVE-2026-87253 Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component:... |
medium | 6.1 | — | Oracle / agile product lifecycle management | 2026-09-15 | 2026-09-23 |
| CVE-2026-78552 The Okta Access Gateway does not apply its Lua directive restriction to the appl... |
medium | 4.9 | — | Okta / access gateway | 2026-09-08 | 2026-09-23 |
| CVE-2026-94382 Beszel before 0.19.0 contains an insecure direct object reference vulnerability... |
medium | 4.2 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-59830 Discourse is an open-source discussion platform. |
medium | 5.4 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-92570 reNgine through 2.2.0 contains an authorization bypass vulnerability in the GetF... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92601 Guns through 8.3.5 contains an improper access control vulnerability in SysNotic... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92754 PatrowlManager through 1.8.4 contains an improper access control vulnerability i... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-92778 CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle... |
medium | 5.4 | — | — | 2026-09-16 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.