September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-54918 NetBox Device Type Library is a collection of community-sourced device type defi... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-58272 Sync-in Server is an open-source platform for file storage, sharing, collaborati... |
medium | 5.3 | — | — | 2026-09-21 | 2026-09-30 |
| CVE-2026-61784 xhtml-purifier is a Node.js library to take in raw/unknown/untrusted HTML and ou... |
medium | 6.1 | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-97723 madpsy ka9q_ubersdr before 0.1.58 has a stored cross-site scripting (XSS) vulner... |
medium | 5.4 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-97724 A prototype pollution vulnerability in Software Mansion React Native Worklets be... |
medium | 4.3 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-97732 IRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticate... |
medium | 5.1 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-97736 tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. |
medium | 5.4 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-88420 A reflected cross-site scripting (XSS) vulnerability in the EntryAbstract.save()... |
medium | 5.4 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-88389 Espruino 2v29 (commit bffc6d0) contains a NULL pointer dereference vulnerability... |
medium | 6.2 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-100230 Input Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-dr... |
medium | 5.3 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-101061 utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side reques... |
medium | 4.7 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-102333 httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs... |
medium | 6.1 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-102362 mall4j through 4.0 fails to implement authentication controls on the DELETE /pro... |
medium | 5.3 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102364 mall4j through 4.0 fails to validate the sysType field in sa-token sessions, all... |
medium | 5.4 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102366 mall4j through 4.0 contains an unrestricted file upload vulnerability in FileCon... |
medium | 4.4 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102367 mall4j through 4.0 contains an insufficient session expiration vulnerability in... |
medium | 5.4 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102372 GestSup versions before 3.2.61 fail to properly sanitize HTML email bodies in th... |
medium | 6.1 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102374 GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerabili... |
medium | 6.1 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102507 Sliver C2 framework version 1.7.7 and earlier contains an unhandled panic vulner... |
medium | 5.7 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102568 Pardus Parental Control before 0.7.0 contains an incorrect authorization vulnera... |
medium | 5.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102879 ClaraVerse through 0.3.1 contains server-side request forgery protection bypasse... |
medium | 5.0 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-53989 Dockhand before 1.0.36 contains an open redirect vulnerability in the OIDC initi... |
medium | 4.7 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-79348 KitchenAsty through 0.3.0 contains a broken object level authorization (IDOR) vu... |
medium | 4.3 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-103053 AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the respons... |
medium | 5.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103057 AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerabilit... |
medium | 4.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103396 bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMidd... |
medium | 4.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-85078 Sanic is an opensource python web server/framework. |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-81868 Steeltoe is an open source project that provides a collection of libraries that... |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-85717 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
medium | 6.8 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-93363 The @payloadcms/storage-vercel-blob storage adapter for Payload contains an impr... |
medium | 4.3 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-89102 In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation fl... |
medium | 6.5 | — | Wolfssl / wolfssl | 2026-09-27 | 2026-09-30 |
| CVE-2026-55632 GoCD is a continuous deliver server. |
medium | 4.3 | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-57179 Python Social Auth is a social authentication/registration mechanism. |
medium | 4.2 | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-51772 A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2)... |
medium | 6.5 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-78902 Cross Site Scripting vulnerability in Netgate pfSense 26.03.1-RELEASE allows an... |
medium | 6.1 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-100632 Parse Server is an open-source backend server. |
medium | 6.5 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-101042 Parse Server is an open-source backend server. |
medium | 6.4 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2024-58386 ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability... |
medium | 6.5 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-102296 ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in Remo... |
medium | 6.5 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-102297 ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the F... |
medium | 4.3 | — | — | 2026-09-28 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.