September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-97469 PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked u... |
medium | 4.3 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-88059 Angular is a development platform for building mobile and desktop web applicatio... |
medium | 5.8 | — | Angular / angular | 2026-09-10 | 2026-09-29 |
| CVE-2026-69361 Server-side request forgery (ssrf) in Microsoft Exchange Server allows an author... |
medium | 6.5 | — | Microsoft / exchange server | 2026-09-08 | 2026-09-29 |
| CVE-2026-94397 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of... |
medium | 6.5 | — | Elastic / elasticsearch | 2026-09-26 | 2026-09-29 |
| CVE-2026-94398 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of... |
medium | 6.5 | — | Elastic / elasticsearch | 2026-09-26 | 2026-09-29 |
| CVE-2026-85290 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
medium | 5.3 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-39372 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
medium | 4.9 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-101203 A vulnerability has been found in FastStone Image Viewer up to 8.3. |
medium | 6.3 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-100192 X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /ap... |
medium | 6.5 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-94399 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of... |
medium | 6.5 | — | Elastic / elasticsearch | 2026-09-26 | 2026-09-29 |
| CVE-2026-94400 Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service... |
medium | 6.5 | — | Elastic / kibana | 2026-09-26 | 2026-09-29 |
| CVE-2026-77909 Insufficiently protected credentials in Azure CycleCloud allows an authorized at... |
medium | 6.5 | — | Microsoft / azure cyclecloud | 2026-09-08 | 2026-09-29 |
| CVE-2026-69367 Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to di... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-69376 Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to di... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-97886 A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to... |
medium | 6.3 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-18117 Concrete CMS 9.0.0 through 9.5.3 is vulnerable to stored XSS via the custom page... |
medium | 5.4 | — | Concretecms / concrete cms | 2026-09-14 | 2026-09-29 |
| CVE-2026-88894 Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company S... |
medium | 5.4 | — | Snipeitapp / snipe-it | 2026-09-10 | 2026-09-29 |
| CVE-2026-100691 Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulne... |
medium | 5.4 | — | Gohugo / hugo | 2026-09-26 | 2026-09-29 |
| CVE-2026-94417 When an application enables both OCSP and CRL revocation checking on one WOLFSSL... |
medium | 5.3 | — | Wolfssl / wolfssl | 2026-09-27 | 2026-09-29 |
| CVE-2026-55770 OpenBao is an open source identity-based secrets management system. |
medium | 6.8 | — | — | 2026-09-15 | 2026-09-29 |
| CVE-2026-55776 OpenBao is an open source identity-based secrets management system. |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-29 |
| CVE-2026-88057 Angular is a development platform for building mobile and desktop web applicatio... |
medium | 6.1 | — | Angular / angular | 2026-09-10 | 2026-09-29 |
| CVE-2026-88058 Angular is a development platform for building mobile and desktop web applicatio... |
medium | 6.1 | — | Angular / angular | 2026-09-10 | 2026-09-29 |
| CVE-2026-84206 Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit p... |
medium | 4.3 | — | Snipeitapp / snipe-it | 2026-09-01 | 2026-09-29 |
| CVE-2026-77267 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
medium | 6.5 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-77249 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
medium | 5.3 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-77257 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
medium | 6.5 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-77268 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
medium | 5.5 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-50291 OpenImageIO is a toolset for reading, writing, and manipulating image files of a... |
medium | 5.5 | — | Openimageio / openimageio | 2026-09-17 | 2026-09-29 |
| CVE-2026-101202 A flaw has been found in FastStone Image Viewer up to 8.3. |
medium | 6.3 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-101205 A vulnerability was determined in FastStone Image Viewer up to 8.3. |
medium | 6.3 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-101277 A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.1... |
medium | 6.5 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-101279 A security vulnerability has been detected in Trusted Domain Project OpenDMARC u... |
medium | 6.5 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-101858 A flaw has been found in RaspAP raspap-webgui up to 3.5.5. |
medium | 4.7 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102244 A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. |
medium | 4.3 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102247 A vulnerability was detected in FastAdmin 1.6.1.20250430/1.6.5.20260602. |
medium | 6.8 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102263 A vulnerability has been found in mwasikz robo-cafe-rms up to 228c44a02823f04e85... |
medium | 4.7 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102292 A flaw has been found in coolbeans1212 MateisHomePage-Website up to ea2a4226deec... |
medium | 4.3 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-59156 OpenImageIO is a toolset for reading, writing, and manipulating image files of a... |
medium | 6.5 | — | Openimageio / openimageio | 2026-09-18 | 2026-09-29 |
| CVE-2026-59181 OpenImageIO is a toolset for reading, writing, and manipulating image files of a... |
medium | 6.1 | — | Openimageio / openimageio | 2026-09-18 | 2026-09-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.