September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-44282 Decidim is a participatory democracy framework. |
medium | 4.8 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-50024 GitHacker is a tool that restores Git repositories from exposed .git directories... |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54724 Kiwi TCMS is an open source test management system. |
medium | 6.1 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55591 Signal K Server is a server application that runs on a central hub in a boat. |
medium | 5.8 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55636 Capsule is a multi-tenancy and policy-based framework for Kubernetes. |
medium | 5.7 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-58196 ToolHive is a utility designed to simplify the deployment and management of Mode... |
medium | 4.7 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-59157 webhookd is a minimalist webhook server that triggers shell scripts and external... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54561 MCP Memory Keeper is an MCP server for persistent context management in AI codin... |
medium | 6.2 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55863 motionEye (mEye) is an online interface for a piece of software called "motion,"... |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-53954 Bugsink is a self-hosted error tracking tool. |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54688 mcp-searxng is a Model Context Protocol server that gives AI assistants web sear... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54689 mcp-searxng is a Model Context Protocol server that gives AI assistants web sear... |
medium | 6.3 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55374 canto-saas-api is a PHP library for interacting with the Canto SaaS API. |
medium | 4.8 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55375 canto-saas-api is a PHP library for interacting with the Canto SaaS API. |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-56830 Shopper is a Headless e-commerce Admin Panel. |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-56831 Shopper is a Headless e-commerce Admin Panel. |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-84993 MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-81176 Svelte devalue is a JavaScript library that serializes values into strings when... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-61589 djust provides Phoenix LiveView-style reactive server-side rendering for Django... |
medium | 6.3 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-63225 Redocly CLI makes OpenAPI validation, linting, and documentation workflows easie... |
medium | 4.4 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-86000 Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-50157 Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-55846 Allure 2 is the version 2.x branch of Allure Report, a multi-language test repor... |
medium | 6.2 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-55847 Allure 2 is the version 2.x branch of Allure Report, a multi-language test repor... |
medium | 6.1 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-53717 Envoy Gateway is an open source project for managing Envoy Proxy as a standalone... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-53716 Envoy Gateway is an open source project for managing Envoy Proxy as a standalone... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-53719 Envoy Gateway is an open source project for managing Envoy Proxy as a standalone... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-62280 Open Access Management (OpenAM) is an access management solution. |
medium | 6.1 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-48722 Nextflow is a DSL for data-driven computational pipelines. |
medium | 5.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54168 Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in s... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54503 plone.app.textfield provides a zope.schema-style field type called RichText for... |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55226 Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-77401 Zope AccessControl provides a general security framework for use in Zope. |
medium | 6.8 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-59944 Composer is a dependency Manager for the PHP language. |
medium | 6.1 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-62949 AsyncSSH is a Python package which provides an asynchronous client and server im... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-85718 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
medium | 5.9 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-44235 rabbitmq-c is a C-language AMQP client library for RabbitMQ. |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-54546 CloudTAK is a browser-based Common Operating Picture and situational awareness t... |
medium | 5.0 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-94419 Without NO_SESSION_CACHE_REF, wolfSSL_get_session() does not return a session ob... |
medium | 5.4 | — | Wolfssl / wolfssl | 2026-09-27 | 2026-09-30 |
| CVE-2026-54677 Scoold is a Q&A and a knowledge sharing platform for teams. |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.