September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-94076 Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 version... |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-93651 Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2... |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-93770 Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-93771 Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 vers... |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-93621 Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions. |
high | 8.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-93624 Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versi... |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-93512 Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-93514 Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5.2... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-62085 Administrator SQL Injection in WP Activity Log <= 5.6.6 versions. |
high | 7.6 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-27371 Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102874 A vulnerability was identified in HKUDS AnyTool 0.1.0. |
high | 7.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102909 A vulnerability was identified in SourceCodester Online Reviewer Management Syst... |
high | 7.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102395 Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps <= 1.14.6 version... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102396 Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic <= 1.5.... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102398 Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versi... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102385 Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2024-42002 A code injection vulnerability has been discovered in the Robot Operating System... |
high | 8.4 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-102616 A vulnerability was detected in risesoft-y9 WorkFlow-Engine up to 9.6.10. |
high | 7.3 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-94286 An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 c... |
high | 7.1 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-86530 BUFFALO Wi-Fi products handle some web form input improperly to assemble command... |
high | 7.2 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-100638 SiYuan versions before v3.8.4 contain a path traversal vulnerability in the setN... |
high | 7.6 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100605 Flowise through 3.1.4 contains missing route-level RBAC checks on chat message e... |
high | 7.1 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-102327 Incorrect authorization in WebView in Google Chrome on on Android prior to 154.0... |
high | 7.5 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-69313 Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attack... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-69325 Heap-based buffer overflow in Microsoft JScript allows an unauthorized attacker... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-69329 Out-of-bounds read in BranchCache allows an unauthorized attacker to deny servic... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-69336 Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attack... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-69338 Use after free in Remote Desktop Gateway Service allows an authorized attacker t... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-69355 External control of file name or path in Microsoft Exchange Server allows an aut... |
high | 8.8 | — | Microsoft / exchange server | 2026-09-08 | 2026-09-30 |
| CVE-2026-69358 Use of uninitialized resource in Remote Desktop Client allows an authorized atta... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-100315 A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5d... |
high | 7.3 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100585 OpenClaw (npm package `openclaw`) before 2026.7.1 fails to enforce the owner-onl... |
high | 8.0 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100589 OpenClaw versions before 2026.7.1 contain a sandbox bypass vulnerability in the... |
high | 8.3 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100597 OpenClaw (npm package 'openclaw') before 2026.7.1 is vulnerable to a time-of-che... |
high | 7.8 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100552 OpenClaw (npm package 'openclaw') before 2026.8.1 does not correctly enforce per... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100560 OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-88885 Renovate before 44.14.7 contains a command injection vulnerability in the gomod... |
high | 7.0 | — | — | 2026-09-10 | 2026-09-29 |
| CVE-2026-88886 Renovate is a dependency update automation tool. |
high | 7.8 | — | — | 2026-09-10 | 2026-09-29 |
| CVE-2026-88887 Renovate is a dependency update automation tool. |
high | 8.6 | — | — | 2026-09-10 | 2026-09-29 |
| CVE-2026-88888 Renovate before 44.14.7 contains a command injection vulnerability in the Mix ma... |
high | 7.0 | — | — | 2026-09-10 | 2026-09-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.