September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-102567 CTranslate2 before 4.8.1 contains an out-of-bounds heap read vulnerability in th... |
medium | 6.1 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102809 PX4 Autopilot through 1.17.0 contains an uncontrolled stack allocation vulnerabi... |
medium | 6.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-81841 Pausing a shared (public) dashboard did not revoke its access token for the endp... |
medium | 5.3 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-81842 An authenticated user with edit permission on one folder can move a library pane... |
medium | 4.3 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-13719 An authenticated user can list alert rules stored in folders they are not allowe... |
medium | 4.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-13720 An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana... |
medium | 5.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-92872 Pgpool-II inserts sensitive information into log file, which may allow an authen... |
medium | 4.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-81310 Image Scanner Driver for Linux contains a link following vulnerability. |
medium | 6.6 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103116 A weakness has been identified in OS4ED openSIS-Classic up to 9.3. |
medium | 6.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103222 A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. |
medium | 5.6 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-101033 KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller... |
medium | 4.3 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-17413 IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31,... |
medium | 5.1 | — | Ibm / power system s1122 \(9824-22a\) firmware | 2026-09-24 | 2026-09-30 |
| CVE-2026-17503 IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31,... |
medium | 5.1 | — | Ibm / power system s1122 \(9824-22a\) firmware | 2026-09-24 | 2026-09-30 |
| CVE-2026-78229 Image Scanner Driver for Linux contains an OS command injection vulnerability. |
medium | 6.7 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-77421 JLine is a Java library for handling console input. |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-61811 Wazuh is an open-source security platform providing unified XDR and SIEM protect... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-102305 UI misrepresentation in SignIn in Google Chrome on on iOS prior to 154.0.8037.92... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-71972 U-Boot through 2026.10-rc5 contains an out-of-bounds write vulnerability in the... |
medium | 5.9 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-100418 Flame through 2.4.0 contains an information exposure vulnerability in the unauth... |
medium | 5.3 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-100502 Flame through 2.4.0 contains an insufficient session expiration vulnerability in... |
medium | 5.0 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-100699 Nodemailer is a Node.js email-sending library. |
medium | 5.3 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100701 Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is... |
medium | 5.9 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100702 Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recip... |
medium | 5.9 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-102570 ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulne... |
medium | 5.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102456 EasyFlow .NET developed by Digiwin has an SQL Injection vulnerability. |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102457 EasyFlow .NET developed by Digiwin has an Arbitrary File Read vulnerability. |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102459 EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerab... |
medium | 6.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-95287 Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allo... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95288 UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95289 Incorrect authorization in Scroll in Google Chrome prior to 154.0.8037.57 allowe... |
medium | 4.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95291 UI misrepresentation in SecurityIndicators in Google Chrome on on iOS prior to 1... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95292 Incorrect authorization in Safebrowsing in Google Chrome prior to 154.0.8037.57... |
medium | 4.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-86556 There is an information disclosure vulnerability in ZTE U30 Air. |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-95320 Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allo... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95323 UI misrepresentation in Chromium in Google Chrome on on iOS prior to 154.0.8037.... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-100143 The FluentCart A New Era of eCommerce WordPress plugin before 1.6.5 does not ver... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-75824 The User Frontend WordPress plugin before 4.3.12 does not check whether the site... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-80333 The Solace Extra WordPress plugin before 1.7.2 does not perform any authorizatio... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-83560 The New User Approve WordPress plugin before 3.2.10 does not properly verify aut... |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-85001 The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of... |
medium | 6.8 | — | — | 2026-09-30 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.