September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-59956 OpenImageIO is a toolset for reading, writing, and manipulating image files of a... |
medium | 6.1 | — | Openimageio / openimageio | 2026-09-18 | 2026-09-29 |
| CVE-2026-100286 Missing authorization in the data source settings API in Devolutions Server 2026... |
medium | 6.5 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-100287 Missing authorization in the attachment history API in Devolutions Server 2026.3... |
medium | 5.4 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-100289 Missing authorization in the gateway network scan token API in Devolutions Serve... |
medium | 5.0 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-93330 Improper rule enforcement in the PAM Active Directory provider in Devolutions Se... |
medium | 4.3 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-63420 OpenImageIO is a toolset for reading, writing, and manipulating image files of a... |
medium | 5.5 | — | Openimageio / openimageio | 2026-09-18 | 2026-09-29 |
| CVE-2026-63635 OpenImageIO is a toolset for reading, writing, and manipulating image files of a... |
medium | 5.5 | — | Openimageio / openimageio | 2026-09-18 | 2026-09-29 |
| CVE-2026-65969 OpenImageIO is a toolset for reading, writing, and manipulating image files of a... |
medium | 5.5 | — | Openimageio / openimageio | 2026-09-18 | 2026-09-29 |
| CVE-2026-65970 OpenImageIO is a toolset for reading, writing, and manipulating image files of a... |
medium | 5.3 | — | Openimageio / openimageio | 2026-09-18 | 2026-09-29 |
| CVE-2026-65127 NVIDIA Infrastructure Controller for Linux contains a vulnerability where an att... |
medium | 4.9 | — | Nvidia / infra controller | 2026-09-22 | 2026-09-29 |
| CVE-2026-88060 Angular is a development platform for building mobile and desktop web applicatio... |
medium | 6.1 | — | Angular / angular | 2026-09-10 | 2026-09-29 |
| CVE-2026-94396 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of... |
medium | 6.5 | — | Elastic / elasticsearch | 2026-09-26 | 2026-09-29 |
| CVE-2026-82294 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial... |
medium | 6.5 | — | Elastic / elasticsearch | 2026-09-26 | 2026-09-29 |
| CVE-2026-65112 NVIDIA Infrastructure Controller for Linux contains a vulnerability where an att... |
medium | 6.5 | — | Nvidia / infra controller | 2026-09-22 | 2026-09-29 |
| CVE-2026-96651 Plex Media Server before 1.43.3.10861 builds a file path from the url parameter... |
medium | 6.5 | — | Plex / media server | 2026-09-23 | 2026-09-29 |
| CVE-2026-65115 NVIDIA Infrastructure Controller for Linux contains a vulnerability where an att... |
medium | 6.5 | — | Nvidia / infra controller | 2026-09-22 | 2026-09-29 |
| CVE-2026-100521 Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in... |
medium | 6.1 | — | — | 2026-09-26 | 2026-09-29 |
| CVE-2026-100529 OpenClaw versions before 2026.8.1 contain an authorization scope widening vulner... |
medium | 6.4 | — | — | 2026-09-26 | 2026-09-29 |
| CVE-2026-100533 OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in the... |
medium | 5.3 | — | — | 2026-09-26 | 2026-09-29 |
| CVE-2026-100304 TDuck survey form 6.0 contains an information disclosure vulnerability in FormAu... |
medium | 5.3 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-96606 A security flaw has been discovered in LB-Link BL-CPE600EU 5.8.13. |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-29 |
| CVE-2026-84540 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-29 |
| CVE-2026-44940 The rancher-extension-stackstate extension in SUSE Observability exposes service... |
medium | 5.7 | — | — | 2026-09-17 | 2026-09-29 |
| CVE-2026-100574 OpenClaw (npm package 'openclaw') before 2026.8.1 contains a server-side request... |
medium | 5.9 | — | — | 2026-09-26 | 2026-09-29 |
| CVE-2026-100545 OpenClaw (npm package `openclaw`) before 2026.8.1 incorrectly enforces sender to... |
medium | 5.3 | — | — | 2026-09-26 | 2026-09-29 |
| CVE-2026-100549 OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in QQBo... |
medium | 5.4 | — | — | 2026-09-26 | 2026-09-29 |
| CVE-2026-100553 OpenClaw versions >= 2026.6.9 and < 2026.8.1 do not declare the native chatId pa... |
medium | 4.3 | — | — | 2026-09-26 | 2026-09-29 |
| CVE-2026-63498 Snipe-IT is an IT asset/license management system. |
medium | 5.4 | — | Snipeitapp / snipe-it | 2026-09-24 | 2026-09-29 |
| CVE-2026-62762 Null pointer dereference in Active Directory Domain Services allows an authorize... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-65812 Insertion of sensitive information into sent data in Microsoft Teams for Android... |
medium | 6.8 | — | Microsoft / teams | 2026-09-08 | 2026-09-29 |
| CVE-2026-68852 Use of uninitialized resource in Microsoft Account allows an authorized attacker... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-78214 An authentication bypass vulnerability exists in the protection of Actuator endp... |
medium | 5.3 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-81569 An improper authorization vulnerability exists in the handling of sub-workflow t... |
medium | 4.3 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-88026 Improper neutralization of regular-expression metacharacters in the LINQ query t... |
medium | 6.5 | — | Mongodb / c\# driver | 2026-09-10 | 2026-09-29 |
| CVE-2026-58504 draw.io is a configurable diagramming and whiteboarding application. |
medium | 6.1 | — | — | 2026-09-21 | 2026-09-29 |
| CVE-2026-61744 InvenTree is an Open Source Inventory Management System. |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-29 |
| CVE-2026-71897 An improper authorization check in Apache DolphinScheduler allows an authenticat... |
medium | 4.3 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-71898 An incorrect authorization check in Apache DolphinScheduler allows an authentica... |
medium | 4.3 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-88028 Improper neutralization of special elements in data query logic in the polymorph... |
medium | 6.5 | — | Mongodb / laravel mongodb | 2026-09-10 | 2026-09-29 |
| CVE-2026-68881 Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to di... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.