September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,171
Critical
1,210
High
4,305
Medium
4,059
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-85037 The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a cli... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-85132 The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or... |
medium | 4.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-85133 The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or... |
medium | 5.4 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-85418 The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fo... |
medium | 5.4 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-85117 The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode pars... |
medium | 6.5 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-83541 The Sina Extension for Elementor WordPress plugin before 3.10.4 does not properl... |
medium | 6.8 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-84113 The Quentn WP WordPress plugin before 1.2.15 does not properly sanitise and esca... |
medium | 4.1 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-84222 The Kirki WordPress plugin before 6.3.0 does not check whether the requester is... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-83537 The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-sid... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-82184 The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have any authoris... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-82185 The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability o... |
medium | 4.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-82848 The Masteriyo LMS WordPress plugin before 3.4.0 does not perform any authorizati... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-81022 The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-81741 The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin bef... |
medium | 4.7 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-80339 The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does n... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-80340 The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does n... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-80341 The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does n... |
medium | 5.9 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-81021 The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-80440 The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submi... |
medium | 4.8 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-78742 Silverpeas Core <=6.4.6 is vulnerable to Cross Site Scripting (XSS) via the Mult... |
medium | 6.1 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-75861 The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not... |
medium | 6.5 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-75905 The WP Recipe Maker plugin for WordPress is vulnerable to authorization bypass i... |
medium | 4.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-74859 The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives wi... |
medium | 6.8 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-55512 nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-58113 A vulnerability has been identified in Teamcenter V2412 (All versions < V2412.00... |
medium | 6.1 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-19800 The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emai... |
medium | 4.9 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-19802 The Checkout Custom Fields Builder for WooCommerce plugin for WordPress is vulne... |
medium | 4.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-19855 The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, use... |
medium | 6.5 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-18042 The WP Travel WordPress plugin before 12.0.2 does not verify that the requester... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-17443 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.... |
medium | 6.5 | — | Ibm / app connect enterprise | 2026-09-04 | 2026-09-09 |
| CVE-2026-75165 An issue in /cgi-bin/wwwugw.cgi of MBS-Solutions X-Serie Gateway firmware V6_00_... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-78741 Silverpeas Core <=6.4.6 is vulnerable to Cross Site Scripting (XSS) in the wysiw... |
medium | 6.1 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-87732 An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. |
medium | 6.2 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-87733 An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. |
medium | 6.2 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-87737 An issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml. |
medium | 5.9 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-17469 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause... |
medium | 5.5 | — | Ibm / i | 2026-09-04 | 2026-09-09 |
| CVE-2026-86550 NuBrowser lacks protocol whitelist validation for the S.browser_fallback_url fie... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-67395 A path traversal vulnerability exists in Sage Employee Self Service’s custom log... |
medium | 5.9 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-11838 Missing authentication for critical function vulnerability in Yordam Informatics... |
medium | 4.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-19733 Server-Side request forgery (SSRF) vulnerability in Yordam Informatics Technolog... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.