September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-95315 Use after free in Aura in Google Chrome prior to 154.0.8037.57 allowed a local a... |
high | 7.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95319 Use after free in Printing in Google Chrome prior to 154.0.8037.57 allowed a rem... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-75823 The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with... |
high | 7.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-85573 The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site'... |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-88797 The Vayu X WordPress theme before 1.0.6 does not perform any capability check on... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-89193 The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values t... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-91832 The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the non... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-92994 The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not va... |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-95333 Use after free in Metrics in Google Chrome prior to 154.0.8037.57 allowed a remo... |
high | 8.1 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95334 Incorrect reference resolution in WebProtect in Google Chrome prior to 154.0.803... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95335 Use after free in HID in Google Chrome prior to 154.0.8037.57 allowed a remote a... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95338 Use after free in PDFium in Google Chrome prior to 154.0.8037.57 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95341 Improper input validation in Desktop in Google Chrome prior to 154.0.8037.57 all... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95343 Use after free in WebAudio in Google Chrome prior to 154.0.8037.57 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95345 Use after free in Actor in Google Chrome prior to 154.0.8037.57 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95348 Use after free in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed a re... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95351 Use after free in Views in Google Chrome prior to 154.0.8037.57 allowed a remote... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95353 Use after free in Bindings in Google Chrome prior to 154.0.8037.57 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95354 Use after free in Verifier in Google Chrome prior to 154.0.8037.57 allowed a rem... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95355 Incorrect authorization in Navigation in Google Chrome on on iOS prior to 154.0.... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-96649 The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin pl... |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97347 The Post Views Stats Counter plugin for WordPress is vulnerable to Stored Cross-... |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96326 The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPres... |
high | 7.2 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-92370 An improper access control vulnerability in TeamViewer Full Client, Host, and re... |
high | 8.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-92371 TeamViewer Full Client and Host for Linux prior version 15.82 contains an improp... |
high | 7.0 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-92368 TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain... |
high | 7.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-92369 TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCT... |
high | 7.3 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-86450 Insertion of sensitive information into sent data vulnerability in Parla Auto Au... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-89294 The Simply Schedule Appointments plugin for WordPress is vulnerable to Local Fil... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-86158 Missing authentication in the local .NET backend (Fiddler.WebUi) of Progress Sof... |
high | 7.7 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-75098 The Product Designer App plugin for WordPress is vulnerable to Directory Travers... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-18783 Missing authentication for critical function vulnerability in Trex Digital Smart... |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-6806 The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-65102 NVIDIA DeepStream contains a vulnerability where an attacker could cause an inte... |
high | 7.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-62097 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-19743 Improper path validation in the local IPC service of TeamViewer Full Client and... |
high | 7.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-103270 LightLLM through 1.2.0 mounts reinforcement learning control routes on the publi... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-100870 Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build admini... |
high | 8.8 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100871 Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to incl... |
high | 8.8 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100851 AzuraCast before 0.23.8 contains a broken access control vulnerability in the GE... |
high | 7.6 | — | — | 2026-09-27 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.