September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-68895 Numeric truncation error in Internet Storage Name Service allows an authorized a... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-69375 Authorization bypass through user-controlled key in Microsoft Exchange Server al... |
medium | 6.5 | — | Microsoft / exchange server | 2026-09-08 | 2026-09-29 |
| CVE-2026-82385 Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.... |
medium | 6.5 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-82387 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 5.4 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-63342 Hatchet is a platform for orchestrating background tasks, AI agents, and durable... |
medium | 6.3 | — | — | 2026-09-21 | 2026-09-29 |
| CVE-2026-62370 KubeEdge is an open source system for extending native containerized application... |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-29 |
| CVE-2026-48974 HomeBox is a home inventory and organization system. |
medium | 5.4 | — | — | 2026-09-21 | 2026-09-29 |
| CVE-2026-69382 Use of a broken or risky cryptographic algorithm in Microsoft Exchange Server al... |
medium | 5.9 | — | Microsoft / exchange server | 2026-09-08 | 2026-09-29 |
| CVE-2026-69395 Use of externally-controlled format string in Active Directory Certificate Servi... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-17504 IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31,... |
medium | 4.4 | — | Ibm / power system s1122 \(9824-22a\) firmware | 2026-09-24 | 2026-09-29 |
| CVE-2026-77250 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
medium | 6.1 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-69559 Origin validation error in Microsoft Teams for Android allows an authorized atta... |
medium | 6.3 | — | Microsoft / teams | 2026-09-08 | 2026-09-29 |
| CVE-2026-77251 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
medium | 6.5 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-46650 Joplin is an open source note-taking and to-do application that organises notes... |
medium | 4.4 | — | — | 2026-09-21 | 2026-09-29 |
| CVE-2026-101093 Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in adm... |
medium | 5.4 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-77825 IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversa... |
medium | 4.9 | — | Ibm / contextforge | 2026-09-24 | 2026-09-29 |
| CVE-2026-13018 Insufficient validation of untrusted input in Codecs in Google Chrome prior to 1... |
medium | 4.3 | — | Google / chrome | 2026-09-28 | 2026-09-29 |
| CVE-2026-11871 The Team Members WordPress plugin before 9.3 does not perform any authorization... |
medium | 5.3 | — | — | 2026-09-26 | 2026-09-29 |
| CVE-2026-77269 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
medium | 6.5 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-57222 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
medium | 5.3 | — | Oisf / suricata | 2026-09-18 | 2026-09-29 |
| CVE-2026-94625 vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConn... |
medium | 5.3 | — | Vllm / vllm | 2026-09-21 | 2026-09-29 |
| CVE-2026-68843 Use after free in Microsoft Office Word allows an authorized attacker to disclos... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-102261 A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. |
medium | 5.4 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-97647 A security vulnerability has been detected in ningzichun student-management-syst... |
medium | 5.3 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-97322 A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-97365 A vulnerability was determined in chonkie-inc littrs 0.6.1/0.6.2. |
medium | 6.3 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-77320 TREK is a collaborative travel planner. |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-52850 Docmost is open-source collaborative wiki and documentation software. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-56792 Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper... |
medium | 4.4 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-48542 Krayin CRM through 2.2.6 contains a stored client-side template injection vulner... |
medium | 5.4 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-96678 A security vulnerability has been detected in weiqingwen spring-boot-forum up to... |
medium | 6.3 | — | — | 2026-09-23 | 2026-09-29 |
| CVE-2026-96763 A security flaw has been discovered in kvcache-ai mooncake up to 0.3.12/0.3.13.p... |
medium | 5.4 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-96777 A vulnerability was determined in Forma LMS up to 4.1.43. |
medium | 6.3 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-96882 A vulnerability was identified in TaleLin lin-cms-spring-boot up to 0.2.1. |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-97061 Black Candy through 3.2.1 fails to scope playlist search queries to the authenti... |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-91132 Discourse is an open-source discussion platform. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-91134 Discourse is an open-source discussion platform. |
medium | 5.4 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-88387 LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::... |
medium | 5.5 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-88377 Bento4 1.6.0.0 contains an integer underflow vulnerability in the avcC and hvcC... |
medium | 6.2 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-88358 simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::pars... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.