September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100861 heym before 0.0.105 fails to apply egress guards to integration services that us... |
medium | 5.0 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100869 Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions... |
medium | 5.9 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-101050 Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on... |
medium | 6.5 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-101085 Nezha before 2.3.8 fails to validate alert rule type and duration bounds, allowi... |
medium | 6.5 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-93364 Bludit CMS through 3.22.0 contains a mass assignment vulnerability that allows a... |
medium | 4.3 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-93365 Bludit CMS through 3.22.0 contains a missing authorization vulnerability that al... |
medium | 6.5 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-100305 TDuck survey form through 6.0 fails to enforce form fill-in restrictions on the... |
medium | 4.3 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-100626 capgo through 12.128.2 contains an insecure direct object reference vulnerabilit... |
medium | 4.3 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-6544 IBM Concert 1.0.0 through 3.0.0 allows recursive copying of directories without... |
medium | 6.2 | — | Ibm / concert | 2026-09-24 | 2026-09-28 |
| CVE-2026-6925 IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to traverse direct... |
medium | 5.3 | — | Ibm / concert | 2026-09-23 | 2026-09-28 |
| CVE-2026-70582 Concurrent execution using shared resource with improper synchronization ('race... |
medium | 6.4 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-77492 Out-of-bounds read in Storage Port Driver allows an authorized attacker to discl... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-76804 Nuclei is a vulnerability scanner built on a simple YAML-based DSL. |
medium | 5.5 | — | — | 2026-09-22 | 2026-09-28 |
| CVE-2026-83602 Netdata is an open source observability tool. |
medium | 6.5 | — | — | 2026-09-22 | 2026-09-28 |
| CVE-2026-100590 OpenClaw before 2026.7.1 contains an authorization bypass vulnerability in the /... |
medium | 4.3 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100594 OpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability... |
medium | 6.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100313 A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to... |
medium | 4.3 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-12910 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6... |
medium | 5.4 | — | Gitlab / gitlab | 2026-09-15 | 2026-09-28 |
| CVE-2026-82837 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.... |
medium | 4.3 | — | Gitlab / gitlab | 2026-09-15 | 2026-09-28 |
| CVE-2026-100902 A vulnerability was determined in Barco ClickShare CX-20 Gen2 up to 02.26.00.000... |
medium | 6.5 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100659 Netty's HTTP/3 codec (io.netty:netty-codec-http3) in versions 4.2.0.Final throug... |
medium | 6.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100667 grav-plugin-login (the Grav CMS Login plugin) versions >= 3.8.7 and < 3.9.7 allo... |
medium | 5.3 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-86341 GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 bef... |
medium | 4.4 | — | Gitlab / gitlab | 2026-09-16 | 2026-09-28 |
| CVE-2026-92529 GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 bef... |
medium | 4.3 | — | Gitlab / gitlab | 2026-09-24 | 2026-09-28 |
| CVE-2026-92530 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1... |
medium | 4.3 | — | Gitlab / gitlab | 2026-09-24 | 2026-09-28 |
| CVE-2026-6327 IBM Concert 1.0.0 through 3.0.0 could allow an unauthorized user to inject data... |
medium | 4.3 | — | Ibm / concert | 2026-09-23 | 2026-09-28 |
| CVE-2026-6718 IBM Concert 1.0.0 through 3.0.0 is vulnerable to improper access control which a... |
medium | 6.2 | — | Ibm / concert | 2026-09-23 | 2026-09-28 |
| CVE-2026-3626 IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to obtain sensitiv... |
medium | 5.3 | — | Ibm / concert | 2026-09-23 | 2026-09-28 |
| CVE-2026-45752 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
medium | 5.9 | — | Oisf / suricata | 2026-09-10 | 2026-09-28 |
| CVE-2026-45763 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
medium | 5.9 | — | Oisf / suricata | 2026-09-10 | 2026-09-28 |
| CVE-2026-93989 vLLM through 0.29.0 fails to properly validate bad_words token indices against t... |
medium | 4.3 | — | Vllm / vllm | 2026-09-19 | 2026-09-28 |
| CVE-2026-57224 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
medium | 6.5 | — | Oisf / suricata | 2026-09-18 | 2026-09-28 |
| CVE-2026-57226 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
medium | 5.9 | — | Oisf / suricata | 2026-09-18 | 2026-09-28 |
| CVE-2026-93840 vLLM before 0.29.0 validates allowed_token_ids against tokenizer length instead... |
medium | 5.3 | — | Vllm / vllm | 2026-09-18 | 2026-09-28 |
| CVE-2026-93841 vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bi... |
medium | 5.3 | — | Vllm / vllm | 2026-09-18 | 2026-09-28 |
| CVE-2026-57225 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
medium | 5.5 | — | Oisf / suricata | 2026-09-18 | 2026-09-28 |
| CVE-2026-57229 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
medium | 5.3 | — | Oisf / suricata | 2026-09-18 | 2026-09-28 |
| CVE-2026-63449 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
medium | 5.3 | — | Oisf / suricata | 2026-09-18 | 2026-09-28 |
| CVE-2026-63450 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
medium | 5.3 | — | Oisf / suricata | 2026-09-18 | 2026-09-28 |
| CVE-2026-63451 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
medium | 5.5 | — | Oisf / suricata | 2026-09-18 | 2026-09-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.