CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- litespeed technologies web server, litespeedtech litespeed web server +1 moreLiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a...9.4 Critical
graphicsmagickDebianGraphicsMagick WPG File wpg.c ExtractPostscript recursion5.3 Medium- dolusoft software technologies soplogMultiple Vulnerabilities in Dolusoft Software's SOPLOG9.8 Critical
- vaadin, vaadin vaadin-spreadsheet, vaadin-spreadsheet-flow +2 moreMissing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked Cells5.3 Medium
- vaadin @vaadin/charts, @vaadin/component-base, vaadin +2 more +4 morePrototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge6.3 Medium
- cisco catalyst sd-wan managerCisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability9.8 Critical
- os4ed opensis-classicOS4ED openSIS-Classic Save Data DatabaseInc.php db_properties sql injection5.1 Medium
- maksisoft technology, it, and software industry and trade inc. gymUsername Enumeration in Maksisoft Technology's Maksisoft Gym5.3 Medium
wicked2nmSUSESecurity update for wicked2nmNo score- os4ed opensis-classicOS4ED openSIS-Classic Student List Search Endpoint GetStuListFnc.php DBQuery sql injection5.3 Medium
- supsystic photo gallery by supsysticWordPress Photo Gallery by Supsystic plugin <= 1.21.0 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- supsystic popup by supsysticWordPress Popup by Supsystic plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- supsystic ultimate maps by supsysticWordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- supsystic easy google mapsWordPress Easy Google Maps plugin <= 1.14.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- jacob n. breetvelt wp photo album plusWordPress WP Photo Album Plus plugin <= 9.3.02.003 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- kevin stover ninja formsWordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- supreme modules liteWordPress Supreme Modules Lite plugin <= 2.5.63 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- aman cf7 views – complete entry management for contact form 7WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wordpress.org two factorWordPress Two Factor plugin <= 0.16.0 - Denial of Service Attack vulnerability5.3 Medium
- if-so dynamic content personalization, unknown if-so dynamic content personalization +1 moreWordPress If-So Dynamic Content Personalization plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- themeisle mpgWordPress MPG plugin <= 4.2.3 - Sensitive Data Exposure vulnerability5.3 Medium
- cool plugins formkit liteWordPress Cool Formkit Lite plugin <= 2.7.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- knitpay razorpay payment links for woocommerceWordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- kingaddons king addons for elementorWordPress King Addons for Elementor plugin <= 51.1.86 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- david lingren media library assistantWordPress Media LIbrary Assistant plugin <= 3.41 - SQL Injection vulnerability8.5 High
- yith woocommerce tab manager, yithemes yith woocommerce tab manager +1 moreWordPress YITH WooCommerce Tab Manager plugin <= 2.15.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- expresstech quiz and survey masterWordPress Quiz And Survey Master plugin <= 11.2.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- jayson t cote oauth serverWordPress OAuth Server plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- liquid web / stellarwp event ticketsWordPress Event Tickets plugin <= 5.29.5 - SQL Injection vulnerability8.5 High
- wp chill strong testimonialsWordPress Strong Testimonials plugin <= 3.3.11 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- nexcess the events calendarWordPress The Events Calendar plugin <= 6.17.5 - Broken Access Control vulnerability5.4 Medium
- radiustheme review schemaWordPress Review Schema plugin <= 3.1.0 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- chouby polylangWordPress Polylang plugin <= 3.8.9 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- cyberlord92 oauth single sign on – sso (oauth client)WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.2 - Bypass vulnerability vulnerability9.8 Critical
- premmerce permalink manager for woocommerceWordPress Premmerce Permalink Manager for WooCommerce plugin <= 2.3.13 - Cross Site Scripting (XSS) vulnerability7.1 High
- wpfunnelsWordPress WPFunnels plugin <= 3.13.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- jtsternberg cmb2WordPress CMB2 plugin <= 2.13.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- miniorange prevent files / folders accessWordPress Prevent files / folders access plugin <= 2.6.7 - Broken Access Control vulnerability4.3 Medium
- nexcess virtue/ascend/pinnacle toolkitWordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- visual composer website builderWordPress Visual Composer Website Builder plugin <= 45.16.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- villatheme notivoWordPress Notivo plugin <= 1.4.2 - Sensitive Data Exposure vulnerability5.3 Medium
- kreatura layersliderWordPress LayerSlider plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- cyberhobo geo mashupWordPress Geo Mashup plugin <= 1.13.21 - Cross Site Scripting (XSS) vulnerability7.1 High
- cozmoslabs paid member subscriptionsWordPress Paid Member Subscriptions plugin <= 3.0.9 - Bypass Vulnerability vulnerability5.3 Medium
- booking activities team activitiesWordPress Booking Activities plugin <= 1.18.7.1 - PHP Object Injection vulnerability9.8 Critical
- creative themes blocksy companionWordPress Blocksy Companion plugin <= 2.1.55 - Broken Access Control vulnerability6.5 Medium
- shortpixel image optimizerWordPress ShortPixel Image Optimizer plugin <= 6.5.5 - PHP Object Injection vulnerability4.9 Medium
- surecartWordPress SureCart plugin <= 4.7.2 - Privilege Escalation vulnerability7.2 High
- wpfunnels creator lmsWordPress Creator LMS plugin <= 1.2.19 - Path Traversal vulnerability7.5 High
- flexyma allable connectorWordPress AllAble Connector plugin <= 0.13.4 - Broken Access Control vulnerability5.4 Medium
- Show moreLoading…