September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,171
Critical
1,210
High
4,305
Medium
4,059
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-77764 The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its vid... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-77782 The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a pos... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-77788 The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metad... |
medium | 4.9 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-78151 The FormLayer WordPress plugin before 1.0.9 does not perform any authorization c... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-79621 The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content t... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81194 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not pro... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81195 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not per... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81197 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not res... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81199 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not per... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81426 The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81427 The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor s... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81428 The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the... |
medium | 6.5 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81432 The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CS... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81583 The My Login WordPress plugin before 7.2.0 does not enforce the network's regist... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-10821 The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control c... |
medium | 6.6 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-17563 The User Frontend WordPress plugin before 4.3.11 does not enforce its subscripti... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-2688 The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authenticatio... |
medium | 6.5 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-2811 The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header In... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-77793 The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the tota... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-77794 The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-78153 The Restrict User Access WordPress plugin before 2.8.1 does not normalise the RE... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-81571 The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to... |
medium | 4.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-82884 The All in One SEO WordPress plugin before 5.0.0.1 does not sanitise and escape... |
medium | 6.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-83533 The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-sid... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-83547 The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of i... |
medium | 6.8 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-8151 The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does n... |
medium | 5.4 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-14215 The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 d... |
medium | 6.5 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-15232 The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-16966 The Solace Extra WordPress plugin before 1.7.0 does not perform any authorizatio... |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-16983 The Gutentor WordPress plugin before 4.0.6 does not apply the correct context re... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-82182 The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does n... |
medium | 4.1 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-80253 An improper physical access control issue exists in ShizenBox2 (dev-conf). |
medium | 6.8 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-80254 Authorization bypass through user-controlled key issue exists in ShizenBox2 (edg... |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2023-50224 TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability |
medium | 6.5 | Listed | TP-Link / TL-WR841N | 2024-05-03 | 2026-09-03 |
| CVE-2026-84356 UI misrepresentation in FullScreen in Google Chrome prior to 152.0.7977.75 allow... |
medium | 4.3 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84833 A vulnerability was found in ntegrals openbrowser up to 067fc45d649baa961750da8e... |
medium | 4.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84839 A vulnerability was determined in tsi-coop tsi-dpdp-cms up to 0.5.0. |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84840 A vulnerability was identified in tsi-coop tsi-dpdp-cms up to 0.5.0. |
medium | 6.5 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-84885 A vulnerability has been found in simular-ai Agent-S 0.3.1/0.3.2. |
medium | 4.3 | — | — | 2026-09-03 | 2026-09-03 |
| CVE-2026-84887 A vulnerability was identified in simular-ai Agent-S up to 0.3.2. |
medium | 4.3 | — | — | 2026-09-03 | 2026-09-03 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.