September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100876 A vulnerability was found in mathurvishal CloudClassroom-PHP-Project up to 5dade... |
medium | 6.3 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100879 A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. |
medium | 4.3 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100873 A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5d... |
medium | 4.3 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-97316 The Broken Link Notifier WordPress plugin before 2.0.0.1 does not re-validate th... |
medium | 5.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96281 On a multi-user system, a user with an active local login session could downgrad... |
medium | 6.2 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-93332 Improper access control in the partial connection API in Devolutions Server 2026... |
medium | 5.4 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-79535 mbailey VoiceMode <= 8.10.1 is vulnerable to OS Command Injection. |
medium | 6.3 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-76735 A sensitive information disclosure vulnerability exists in the underlying operat... |
medium | 4.1 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-79417 Improper Access Control in ArgusMonitor.sys in Argotronic eGbR ArgusMonitor 7.4.... |
medium | 5.3 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-79534 mark3labs mcp-filesystem-server v0.11.1 is vulnerable to Directory Traversal due... |
medium | 5.9 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-76730 An authentication bypass vulnerability exists in the PAPI protocol of HPE Networ... |
medium | 6.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-76731 An authentication bypass vulnerability in the captive portal of HPE Networking I... |
medium | 6.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-76733 A denial-of-service vulnerability exists in the API endpoint of HPE Networking I... |
medium | 4.9 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-76734 A memory corruption vulnerability in the affected interface of HPE Networking In... |
medium | 4.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-103049 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103050 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103051 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103045 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-103046 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-103047 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102904 JupyterLab is an extensible environment for interactive and reproducible computi... |
medium | 5.4 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102820 pageant provides a [PageantStream] type that implements [AsyncRead] and [AsyncWr... |
medium | 6.2 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102824 Russh is a Rust SSH client and server library. |
medium | 4.3 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102473 A flaw was found in dash. |
medium | 5.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-101861 Langflow 1.0.16 before 1.12.0 and 0.0.94 before 1.12.0 contain an unsafe eval()... |
medium | 4.1 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-100243 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site... |
medium | 6.1 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-100245 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site... |
medium | 6.1 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-100238 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site... |
medium | 6.1 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102310 Missing authorization in Payments in Google Chrome prior to 154.0.8037.92 allowe... |
medium | 6.5 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102312 UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.80... |
medium | 4.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95371 Missing authorization in Views in Google Chrome on on Mac prior to 154.0.8037.57... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95309 UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95307 UI misrepresentation in ExtensionsMenu in Google Chrome prior to 154.0.8037.57 a... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-92869 An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an aut... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94029 Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 t... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-91095 In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWeb... |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-92868 An improper certificate validation vulnerability exists in Pgpool-II, which may... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-88815 DBI versions before 1.654 for Perl incorrectly treat numeric values as strings i... |
medium | 6.2 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-71974 U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in read_... |
medium | 4.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-55174 UltrafastSecp256k1 is a high-performance, multi-backend secp256k1 engine with re... |
medium | 5.9 | — | — | 2026-09-30 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.