September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2016-7255 Microsoft Win32k Privilege Escalation Vulnerability |
high | 7.8 | Listed | Microsoft / Win32k | 2016-11-10 | 2026-09-10 |
| CVE-2026-84942 Improper input validation in the Vega expression function implementation in Open... |
high | 8.7 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-49310 Permission control vulnerability in the event notification module. |
high | 8.6 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-49314 OOB write vulnerability in the rendering and composition module. |
high | 7.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-49315 DoS vulnerability in the input device module. |
high | 7.1 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-84366 Scrapy is a high-level web crawling and scraping framework for Python. |
high | 7.4 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84370 SVGO, short for SVG Optimizer, is a Node.js library and command-line application... |
high | 8.2 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84374 Laravel Excel provides supercharged Excel exports and imports in Laravel. |
high | 7.5 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84989 ntopng is a web-based network traffic monitoring application. |
high | 7.1 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-48486 Signum Node is a HDD-mined cryptocurrency using an energy efficient and fair Pro... |
high | 7.5 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-63219 GeoNetwork is a catalog application to manage spatially referenced resources. |
high | 8.6 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-33630 c-ares is an asynchronous resolver library. |
high | 7.5 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-44506 Medplum is a developer platform that enables development of healthcare apps. |
high | 8.2 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-53728 Medplum is a developer platform that enables development of healthcare apps. |
high | 7.1 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-63376 toml-node is a TOML parser for Node.js and the browser. |
high | 8.2 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-77465 toml-node is a TOML parser for Node.js and the browser. |
high | 7.5 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-49832 DSpace open source software is a repository application which provides durable a... |
high | 8.0 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-84381 HTTPX2 is a next generation HTTP client for Python. |
high | 8.1 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-84382 HTTPX2 is a next generation HTTP client for Python. |
high | 7.5 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-45730 Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. |
high | 8.3 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-52831 Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. |
high | 8.0 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-52833 Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. |
high | 8.0 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-53635 Open edX Platform enables the authoring and delivery of online learning at any s... |
high | 7.6 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-79755 Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. |
high | 8.0 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-82404 TOON is a compact, human-readable serialization of JSON data for LLM prompts. |
high | 8.3 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-85091 zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability... |
high | 7.4 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-79572 An XXE (XML External Entity) vulnerability in the level-rule module of Distribut... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-79617 Incorrect Permission Assignment for Critical Resource vulnerability in TÜBİTAK B... |
high | 7.1 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-78839 An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers... |
high | 8.1 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-75166 Insecure Permission vulnerability in MBS-Solutions X-Serie Gateway firmware V6_0... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-71622 SQL injection vulnerability in Zhao-github APiAdmin v.5.0.1 allows a remote atta... |
high | 7.4 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-55658 Gardens v2 is a modular governance framework that enables communities to create... |
high | 7.7 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-87811 SiYuan before v3.8.2 inserts persisted notebook template paths into HTML input v... |
high | 7.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-87813 SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the... |
high | 7.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-87821 Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerabilit... |
high | 7.1 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-86099 Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionI... |
high | 8.2 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-86199 PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate f... |
high | 7.5 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-79636 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
high | 7.0 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-87823 zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-By... |
high | 8.2 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-87877 zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setL... |
high | 7.7 | — | — | 2026-09-09 | 2026-09-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.