September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-93961 A security flaw has been discovered in Dromara UJCMS up to 12.3.1. |
medium | 5.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-93966 A vulnerability has been found in aiyiyi121 SxDevOps 1.0/1.1. |
medium | 4.7 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-93971 A weakness has been identified in aiyiyi121 SxDevOps 1.0/1.1. |
medium | 5.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-93921 SiYuan versions through 3.8.4 fail to enforce publish access control in the getD... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-85010 The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplie... |
medium | 5.3 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-85113 The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters f... |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-69393 Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to dis... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-21 |
| CVE-2026-91742 Confused deputy in PriceTracking in Google Chrome on on iOS prior to 153.0.8010.... |
medium | 4.8 | — | Google / chrome | 2026-09-15 | 2026-09-21 |
| CVE-2026-69403 Missing authorization in Windows SMB Server allows an authorized attacker to dis... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-21 |
| CVE-2026-82561 Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entir... |
medium | 6.5 | — | Apache / nifi | 2026-09-16 | 2026-09-21 |
| CVE-2026-81866 Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and veri... |
medium | 4.3 | — | Apache / nifi | 2026-09-16 | 2026-09-21 |
| CVE-2026-16557 The Nimble Page Builder WordPress plugin through 3.3.8 does not perform an autho... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-19860 The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3... |
medium | 5.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-84750 The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not vali... |
medium | 6.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-91847 The Online Scheduling and Appointment Booking System WordPress plugin before 28.... |
medium | 4.8 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-92099 The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authori... |
medium | 6.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-92421 The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin b... |
medium | 4.7 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-92425 The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin b... |
medium | 5.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-92430 The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plu... |
medium | 5.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-92435 The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that... |
medium | 5.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-14844 The Master Slider WordPress plugin through 3.11.2 does not sanitise and escape s... |
medium | 6.8 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-16542 The Import and export users and customers WordPress plugin before 2.4.5 does not... |
medium | 4.1 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-81653 The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not... |
medium | 4.2 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-84223 The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files whi... |
medium | 6.8 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-87068 The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role va... |
medium | 6.6 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-87840 The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or own... |
medium | 5.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-92410 The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the... |
medium | 4.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-92422 The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user... |
medium | 6.5 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-77820 The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
medium | 6.4 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-12042 The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Si... |
medium | 4.4 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-15660 The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in v... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-15760 The Divi Essential plugin for WordPress is vulnerable to sensitive information e... |
medium | 6.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-88944 The Tutor LMS – eLearning and online course solution plugin for WordPress is vul... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-89081 The Tutor LMS – eLearning and online course solution plugin for WordPress is vul... |
medium | 6.1 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-89093 The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots pl... |
medium | 5.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-89333 The Tutor LMS – eLearning and online course solution plugin for WordPress is vul... |
medium | 6.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-89334 The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots pl... |
medium | 6.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-92967 The Pochipp plugin for WordPress is vulnerable to Reflected Cross-Site Scripting... |
medium | 6.1 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-11608 The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Si... |
medium | 6.1 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-11899 The PDF Builder for WooCommerce. |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.