September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,171
Critical
1,210
High
4,305
Medium
4,059
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-8625 The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for... |
medium | 6.4 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-14975 The WP File Download plugin for WordPress is vulnerable to Directory Traversal i... |
medium | 6.5 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-18843 The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable t... |
medium | 6.1 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-3853 The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Script... |
medium | 6.4 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-4361 The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all... |
medium | 5.0 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-75018 The Custom Contact Forms plugin for WordPress is vulnerable to authorization byp... |
medium | 4.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-75586 The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Refle... |
medium | 6.1 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-85414 The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site... |
medium | 6.4 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-76573 The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to... |
medium | 6.4 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-12843 The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in... |
medium | 5.4 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-15550 The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Au... |
medium | 4.3 | — | — | 2026-09-05 | 2026-09-08 |
| CVE-2026-81802 Unauthenticated Insecure Direct Object References (IDOR) in WpEvently <= 5.6.0 v... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-08 |
| CVE-2026-32773 There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which... |
medium | 6.1 | — | Apache / spark | 2026-09-02 | 2026-09-08 |
| CVE-2026-85308 Authorization Bypass Through User-Controlled Key vulnerability in Brainstorm For... |
medium | 5.3 | — | — | 2026-09-03 | 2026-09-07 |
| CVE-2026-85311 Missing Authorization vulnerability in Kings Plugins MarketKing allows Exploitin... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-07 |
| CVE-2026-84769 Unauthenticated Insecure Direct Object References (IDOR) in Business Directory <... |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-07 |
| CVE-2026-85302 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-07 |
| CVE-2026-27086 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-07 |
| CVE-2026-85305 Server-Side Request Forgery (SSRF) vulnerability in SEOPress allows Server Side... |
medium | 5.4 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-85309 Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allo... |
medium | 5.3 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-85106 A vulnerability has been found in NousResearch hermes-agent 0.18.0. |
medium | 6.3 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-84758 Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions. |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-84766 Unauthenticated Bypass Vulnerability in FluentBooking Pro <= 2.2.1 versions. |
medium | 5.9 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-84774 Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.11 versions... |
medium | 6.1 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-81281 Subscriber Cross Site Scripting (XSS) in Graphene <= 2.9.4 versions. |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-84886 A vulnerability was determined in simular-ai Agent-S up to 0.3.2. |
medium | 5.3 | — | — | 2026-09-03 | 2026-09-05 |
| CVE-2026-84666 Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier allows... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-56143 Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch... |
medium | 4.9 | — | Elastic / elasticsearch | 2026-09-01 | 2026-09-04 |
| CVE-2026-72633 Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss... |
medium | 4.3 | — | Elastic / kibana | 2026-09-01 | 2026-09-04 |
| CVE-2026-85241 A weakness has been identified in SpecterOps BloodHound up to 9.5.1. |
medium | 6.3 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-85382 A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99... |
medium | 4.3 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-85401 A weakness has been identified in Dolibarr up to 21.0.4/22.0.5/23.0.3. |
medium | 6.3 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-27432 Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vi... |
medium | 5.4 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-32480 Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiti... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-27347 Missing Authorization vulnerability in Crocoblock JetPopup allows Exploiting Inc... |
medium | 5.3 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-85514 A security vulnerability has been detected in StackStorm st2 up to 3.9.0. |
medium | 6.3 | — | — | 2026-09-04 | 2026-09-04 |
| CVE-2026-78609 Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead... |
medium | 5.4 | — | Elastic / elastic cloud on kubernetes | 2026-09-02 | 2026-09-04 |
| CVE-2026-73762 A vulnerability has been identified in the API endpoint of AOS-CX that could all... |
medium | 6.6 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73761 An out-of-bounds read vulnerability exists in the underlying operating system of... |
medium | 6.5 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73760 An authenticated Path Traversal vulnerability exists in AOS-CX. |
medium | 6.5 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.