September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92404 The MgoSync WordPress plugin before 2.1.7 does not have authorization controls o... |
high | 7.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-81650 The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not... |
high | 7.2 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-82842 The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the config... |
high | 8.1 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-85017 The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not per... |
high | 7.5 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-87067 The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which cl... |
high | 8.5 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-87839 The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, an... |
high | 7.5 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-92540 The Import and export users and customers WordPress plugin before 2.5.2 does not... |
high | 7.2 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-92541 The Import and export users and customers WordPress plugin before 2.5.2 does not... |
high | 7.2 | — | — | 2026-09-20 | 2026-09-21 |
| CVE-2026-93031 The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-B... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-13354 The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Stor... |
high | 7.2 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-87909 The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execut... |
high | 7.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-92807 The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Arbitra... |
high | 8.8 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-15664 The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for... |
high | 7.2 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-4327 The The Welcomizer plugin for WordPress is vulnerable to Remote Code Execution i... |
high | 8.8 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-85658 The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User... |
high | 8.1 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-1255 The YS LeadGen plugin for WordPress is vulnerable to Sensitive Information Expos... |
high | 7.5 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-94129 A vulnerability was detected in BioStar VALKYRIE AURORA 2.10.2411.0800. |
high | 8.8 | — | — | 2026-09-21 | 2026-09-21 |
| CVE-2026-87491 Google Chromium V8 Out of Bounds Write Vulnerability |
high | 8.8 | Listed | Google / Chromium V8 | 2026-09-09 | 2026-09-21 |
| CVE-2026-85046 Google Chromium V8 Type Confusion Vulnerability |
high | 8.8 | Listed | Google / Chromium V8 | 2026-09-03 | 2026-09-21 |
| CVE-2026-10751 IBM MQ Java and JMS client libraries could allow an authenticated attacker to ex... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-21 |
| CVE-2026-87247 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 7.5 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-93377 Type confusion in V8 in Google Chrome prior to 153.0.8010.52 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-87246 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 7.2 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-87245 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 8.0 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-87244 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 7.2 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-87192 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 7.1 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-87213 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 7.4 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-87215 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 7.5 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-87216 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 7.8 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-87218 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 8.1 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-87226 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 8.8 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-87227 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 8.8 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-87239 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 7.2 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-89060 A cross-namespace authorization flaw in multicluster-observability-addon allows... |
high | 7.7 | — | — | 2026-09-11 | 2026-09-21 |
| CVE-2026-87228 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 8.2 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-87229 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 8.2 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-87231 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 8.1 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-87232 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 8.1 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-87193 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 7.5 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
| CVE-2026-87194 Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype... |
high | 7.5 | — | Oracle / hyperion financial management | 2026-09-15 | 2026-09-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.