September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,171
Critical
1,210
High
4,305
Medium
4,059
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-79632 The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-80438 The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilit... |
medium | 5.9 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-81347 The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not proper... |
medium | 5.9 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-82186 The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate... |
medium | 4.1 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-82193 The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does n... |
medium | 5.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-82194 The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does n... |
medium | 5.5 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-84146 The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-84044 The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not ve... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-84045 The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 doe... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-84930 The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84931 The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or es... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84936 The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization... |
medium | 5.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84937 The Video Player for YouTube WordPress plugin before 2.1.0 does not properly san... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-85038 The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices,... |
medium | 5.3 | — | — | 2026-09-06 | 2026-09-08 |
| CVE-2026-44766 SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged a... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-76959 SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cr... |
medium | 4.6 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-76962 SAP S/4HANA (Manage Bank Chains app) does not perform sufficient authorization c... |
medium | 4.3 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-76963 Due to a missing authorization check in Application Server ABAP of SAP NetWeaver... |
medium | 4.3 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-76968 SAP Web Dispatcher, Internet Communication Manager and SAP Content Server allows... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-76971 Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP Manufacturing I... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-76977 SAP UI5 does not sufficiently validate the parent frame's origin against the con... |
medium | 4.3 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-85084 Out-of-bounds Write and Improper Validation of Array Index vulnerability in Sams... |
medium | 6.3 | — | — | 2026-09-03 | 2026-09-08 |
| CVE-2026-49509 Out-of-bounds read vulnerability in Samsung Opensource rLottie allows Overread B... |
medium | 4.4 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85149 SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentia... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-84043 The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does no... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-85541 DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerabi... |
medium | 5.4 | — | — | 2026-09-04 | 2026-09-08 |
| CVE-2026-15247 The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or... |
medium | 5.4 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-19861 The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2... |
medium | 4.7 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-78149 The Smart Post WordPress plugin before 4.0.8 does not check whether a post is pa... |
medium | 5.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-81423 The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a use... |
medium | 4.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-81424 The Accept Stripe Payments WordPress plugin before 2.1.4 does not verify that th... |
medium | 5.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-82846 The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape som... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-83543 The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied... |
medium | 4.1 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-83544 The Greenshift WordPress plugin before 13.2.0 does not properly escape a block a... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84021 The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84022 The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84221 The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifi... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84896 The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84898 The Eventin WordPress plugin before 4.1.21 does not properly validate a template... |
medium | 6.6 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-84899 The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape... |
medium | 6.8 | — | — | 2026-09-05 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.