September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,171
Critical
1,210
High
4,305
Medium
4,059
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-73758 A privilege escalation vulnerability exists in the API endpoint of AOS-CX. |
medium | 6.5 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73757 A vulnerability in the web-based management interface of AOS-CX could allow an a... |
medium | 6.4 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73756 A vulnerability in an API endpoint of AOS-CX could allow a remote unauthenticate... |
medium | 5.9 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73754 Denial-of-service vulnerabilities exist in the command line interface of AOS-CX. |
medium | 5.3 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-73772 Buffer overflow vulnerabilities exist in an underlying service of AOS-CX that co... |
medium | 6.5 | — | Hpe / arubaos-cx | 2026-09-01 | 2026-09-04 |
| CVE-2026-85186 A weakness has been identified in itsourcecode Online Medicine Delivery System 1... |
medium | 6.3 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-85306 Missing Authorization vulnerability in Cascadia Web Services MountDev AI MCP Con... |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-81282 Subscriber Cross Site Scripting (XSS) in Product Variations Swatches for WooComm... |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-84754 Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions. |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-84767 Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions. |
medium | 5.3 | — | — | 2026-09-03 | 2026-09-04 |
| CVE-2026-84780 Unauthenticated Denial of Service Attack in WP Go Maps <= 10.1.08 versions. |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-84799 Craft CMS before 5.11.0 fails to enforce user-group scope filters on native Grap... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-84804 Kimai before 2.65.0 fails to properly validate permissions when removing team ac... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-84427 A vulnerability was determined in zhayujie CowAgent up to 2.1.7. |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-84269 A flaw was found in the AFP backend in gvfs. |
medium | 6.5 | — | — | 2026-09-01 | 2026-09-04 |
| CVE-2026-84287 A flaw has been found in NousResearch hermes-agent 0.18.0. |
medium | 4.3 | — | — | 2026-09-01 | 2026-09-04 |
| CVE-2026-3850 The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via th... |
medium | 6.4 | — | — | 2026-09-02 | 2026-09-04 |
| CVE-2026-84110 A vulnerability was detected in Releasit Releasit COD Form & Upsells v1. |
medium | 5.3 | — | — | 2026-09-01 | 2026-09-04 |
| CVE-2026-3851 The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via th... |
medium | 6.4 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-78594 Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to... |
medium | 4.9 | — | Elastic / apm server | 2026-09-02 | 2026-09-03 |
| CVE-2026-78588 Allocation of Resources Without Limits or Throttling (CWE-770) in Filebeat can l... |
medium | 6.5 | — | Elastic / filebeat | 2026-09-02 | 2026-09-03 |
| CVE-2026-85307 Insertion of Sensitive Information Into Sent Data vulnerability in Kevin Pirnie... |
medium | 5.3 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-85303 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-85304 Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For... |
medium | 5.3 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84849 Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce <= 2.3 versio... |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84762 Unauthenticated Bypass Vulnerability in WP EasyPay <= 4.5.3 versions. |
medium | 5.3 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84755 Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions. |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84215 Unauthenticated Broken Access Control in Timetics <= 1.0.61 versions. |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84137 Spoofing issue in the DOM: Core & HTML component. |
medium | 4.3 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84138 Denial-of-service in the PDF Viewer component. |
medium | 6.5 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84139 Clickjacking issue in the DOM: Events component. |
medium | 6.1 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84136 Other issue in the DOM: Navigation component. |
medium | 6.1 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-82968 A flaw was found in the first-broker-login flow of the Keycloak identity managem... |
medium | 6.4 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2021-43613 An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2021-43614 Error in handling the PlatformLangCodes UEFI variable could cause a buffer overf... |
medium | 6.7 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-82293 Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lea... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-19251 The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comm... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-19704 The Comments WordPress plugin before 7.6.66 does not validate a value used to bu... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-19719 The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.... |
medium | 6.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-74927 The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisati... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.