September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-12402 The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Store... |
medium | 4.4 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-13191 The Create plugin for WordPress is vulnerable to generic SQL Injection via the '... |
medium | 6.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-13200 The Create plugin for WordPress is vulnerable to generic SQL Injection via the '... |
medium | 6.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-13770 The AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iO... |
medium | 6.4 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-15098 The Real3D Flipbook Lite plugin for WordPress is vulnerable to Stored Cross-Site... |
medium | 6.4 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-15463 The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress i... |
medium | 6.1 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-15946 The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrat... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-15947 The Metasync plugin for WordPress is vulnerable to unauthorized modification of... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-1242 The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-1641 The Wow Elements Addons for Elementor plugin for WordPress is vulnerable to Serv... |
medium | 6.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-1984 The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unau... |
medium | 5.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-2278 The VW Writer Blog theme for WordPress is vulnerable to unauthorized modificatio... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-2422 The WP Composer – The Easiest Page Builder plugin for WordPress is vulnerable to... |
medium | 6.4 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-4792 The Bread plugin for WordPress is vulnerable to information exposure in versions... |
medium | 5.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-5400 The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 6.4 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-6295 The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's'... |
medium | 4.9 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-75959 The GoPay for WooCommerce plugin for WordPress is vulnerable to generic SQL Inje... |
medium | 4.9 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-7527 The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vu... |
medium | 4.7 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-87917 The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflect... |
medium | 6.1 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-9232 The Easy Appointments plugin for WordPress is vulnerable to Sensitive Informatio... |
medium | 6.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-9615 The Flex Import plugin for WordPress is vulnerable to Missing Authorization in a... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-9832 The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable... |
medium | 5.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-9855 The Custom Field Template plugin for WordPress is vulnerable to generic SQL Inje... |
medium | 6.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-18346 The TikTok plugin for WordPress is vulnerable to authorization bypass in all ver... |
medium | 5.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-1256 The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and St... |
medium | 6.4 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-5410 The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 6.4 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-76579 The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site S... |
medium | 4.7 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-8354 The Gum Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-S... |
medium | 6.4 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-9289 The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sen... |
medium | 5.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-9613 The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress is vulnerabl... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-9766 The Empik for Woocommerce plugin for WordPress is vulnerable to authorization by... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-9858 The Partial Shipment for Woocommerce plugin for WordPress is vulnerable to Missi... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-94049 A flaw has been found in 06ketan slideshot up to 4.4.0. |
medium | 4.3 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94091 A weakness has been identified in piskvorky gensim up to 4.4.0. |
medium | 5.5 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-94149 A vulnerability was identified in Omega Solution HRM OS up to 20260717. |
medium | 4.3 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-87248 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
medium | 6.7 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-93376 Out of bounds read in DataTransfer in Google Chrome prior to 153.0.8010.52 allow... |
medium | 6.3 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-91966 AVideo through 29.0 contains an unauthenticated server-side request forgery vuln... |
medium | 5.8 | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-90971 Server-Side Request Forgery (SSRF) in the VMware synchronization feature in Devo... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-20 |
| CVE-2026-90520 A vulnerability has been found in jaychouchannel Tourism-Management-System up to... |
medium | 6.3 | — | — | 2026-09-13 | 2026-09-20 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.