September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,182
Critical
1,210
High
4,307
Medium
4,068
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86823 The Newsletter WordPress plugin before 9.3.7 does not validate the destination o... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-86784 The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a char... |
medium | 6.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-86447 The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilit... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-86449 The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilit... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-85572 The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has acces... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-85641 The Formidable Forms WordPress plugin before 6.35 does not restrict who can set... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-86445 The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilit... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-85131 The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or c... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-85349 The FluentBoards WordPress plugin before 2.0.15 does not properly verify authori... |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-84088 The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does... |
medium | 6.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-82124 The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-82125 The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-77702 The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-78474 The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not have any... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-76553 The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a pat... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-76555 The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a use... |
medium | 6.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-76556 The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanit... |
medium | 6.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-76557 The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanit... |
medium | 6.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-76558 The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom... |
medium | 6.8 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-76559 The WP Import Export Lite WordPress plugin before 3.9.33 does not properly valid... |
medium | 4.1 | — | — | 2026-09-16 | 2026-09-17 |
| CVE-2026-73465 On affected platforms running Arista EOS, under certain circumstances plaintext... |
medium | 6.3 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-73466 On affected platforms running Arista EOS, under certain circumstances user passw... |
medium | 6.3 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-14276 IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could... |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-17 |
| CVE-2026-14277 IBM i Access Family 1.1.2.0 through 1.1.9.15 could allow an authenticated user t... |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-17 |
| CVE-2026-14275 IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could... |
medium | 6.3 | — | — | 2026-09-14 | 2026-09-17 |
| CVE-2026-68886 Use after free in Windows Network Connection Broker allows an authorized attacke... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-17 |
| CVE-2026-68873 Insertion of sensitive information into log file in Windows Program Compatibilit... |
medium | 5.5 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-17 |
| CVE-2026-43690 A race condition was addressed with improved locking. |
medium | 4.7 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-43719 A use-after-free issue was addressed with improved memory management. |
medium | 6.5 | — | Apple / macos | 2026-09-14 | 2026-09-17 |
| CVE-2026-69820 Heap-based buffer overflow in Windows Hello allows an authorized attacker to ele... |
medium | 6.7 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-16 |
| CVE-2026-81051 Dell ThinOS 10, versions prior to 2605_10.2616, contain a Security Version Numbe... |
medium | 6.6 | — | Dell / thinos | 2026-09-10 | 2026-09-16 |
| CVE-2026-81052 Dell ThinOS 10, versions prior to 2605_10.2616, contain a Download of Code Witho... |
medium | 6.8 | — | Dell / thinos | 2026-09-10 | 2026-09-16 |
| CVE-2026-81900 Concrete CMS before 9.5.3 applied only trim() to the YouTube block's stored widt... |
medium | 6.1 | — | Concretecms / concrete cms | 2026-09-14 | 2026-09-16 |
| CVE-2026-85024 undici bundles a WebSocket client whose permessage-deflate size-limit cleanup re... |
medium | 5.9 | — | Nodejs / undici | 2026-09-04 | 2026-09-16 |
| CVE-2026-68849 Out-of-bounds read in Windows Bluetooth Port Driver allows an authorized attacke... |
medium | 4.7 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-16 |
| CVE-2026-18149 undici's retry handler can leave an already-exposed response body pending foreve... |
medium | 5.9 | — | Nodejs / undici | 2026-09-04 | 2026-09-16 |
| CVE-2026-80176 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 4.7 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-16 |
| CVE-2026-82052 The $regexFindAll expression can be used by an authenticated user who can run ag... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82054 A security issue exists in MongoDB server's JSON Pointer parser used during $jso... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
| CVE-2026-82074 MongoDB Server contains an incorrect authorization vulnerability in the aggregat... |
medium | 6.5 | — | Mongodb / mongodb | 2026-09-08 | 2026-09-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.