September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100373 OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability... |
medium | 4.1 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-77490 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Microsoft / edge chromium | 2026-09-11 | 2026-09-25 |
| CVE-2026-68526 Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar ev... |
medium | 4.3 | — | Concretecms / concrete cms | 2026-09-11 | 2026-09-25 |
| CVE-2026-93395 A missing lower-bound validation in the bson_new_from_buffer() function of libbs... |
medium | 5.3 | — | Mongodb / c driver | 2026-09-17 | 2026-09-25 |
| CVE-2026-52743 GoCD is a continuous deliver server. |
medium | 4.3 | — | — | 2026-09-21 | 2026-09-25 |
| CVE-2026-83946 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Microsoft / azure portal | 2026-09-18 | 2026-09-25 |
| CVE-2026-83488 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: hel... |
medium | 5.4 | — | Oracle / helidon | 2026-09-15 | 2026-09-25 |
| CVE-2026-83480 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Web... |
medium | 5.3 | — | Oracle / helidon | 2026-09-15 | 2026-09-25 |
| CVE-2026-83460 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: LRA... |
medium | 6.5 | — | Oracle / helidon | 2026-09-15 | 2026-09-25 |
| CVE-2026-75656 Bridge is affected by an out-of-bounds read vulnerability that could lead to dis... |
medium | 5.5 | — | Adobe / bridge | 2026-09-22 | 2026-09-25 |
| CVE-2026-93339 Metaphor Creations Ditty (ditty-news-ticker) before 3.1.70 contains a stored cro... |
medium | 5.4 | — | — | 2026-09-21 | 2026-09-25 |
| CVE-2026-88367 NanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvg... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-71459 JobJobEventsChildrenSummary view has no model/parent_model. |
medium | 5.0 | — | — | 2026-09-23 | 2026-09-25 |
| CVE-2026-48543 Krayin CRM through 2.2.6 contains a stored client-side template injection vulner... |
medium | 5.4 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-77252 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
medium | 6.5 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-25 |
| CVE-2026-97636 Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-sc... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-88761 The Botslab G980H dash camera firmware generates the default WiFi password using... |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-88956 The Botslab G980H dash camera firmware contains an authentication vulnerability... |
medium | 6.8 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-88359 libfyaml 0.9.6 contains a stack exhaustion vulnerability in fy_atom_iter_format(... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-88386 libsndfile 1.2.2 contains a misaligned memory access issue in psf_binheader_read... |
medium | 5.5 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-87118 The Botslab G980H dash camera firmware contains an out of bounds write vulnerabi... |
medium | 5.7 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-82585 The Botslab G980H dash camera firmware transmits sensitive information over unen... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-82708 The Botslab G980H dash camera firmware contains a path traversal vulnerability i... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-82716 The Botslab G980H dash camera firmware includes sensitive configuration informat... |
medium | 4.6 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-84403 The Botslab G980H dash camera firmware does not require authenticated pairing or... |
medium | 6.2 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-75558 The Botslab G980H dash camera firmware uses a hard-coded cryptographic key and i... |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-79959 The Botslab G980H dash camera firmware contains a hard-coded root account passwo... |
medium | 6.8 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-36471 Deserialization of Untrusted Data of the __post_data parameter in cn_parse_url()... |
medium | 5.8 | — | — | 2026-09-21 | 2026-09-25 |
| CVE-2026-48361 Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability t... |
medium | 6.1 | — | Adobe / connect | 2026-09-22 | 2026-09-25 |
| CVE-2026-81878 radare2 is a UNIX-like reverse engineering framework and command-line toolset. |
medium | 5.5 | — | Radare / radare2 | 2026-09-22 | 2026-09-25 |
| CVE-2026-81879 radare2 is a UNIX-like reverse engineering framework and command-line toolset. |
medium | 6.1 | — | Radare / radare2 | 2026-09-22 | 2026-09-25 |
| CVE-2026-81881 radare2 is a UNIX-like reverse engineering framework and command-line toolset. |
medium | 4.4 | — | Radare / radare2 | 2026-09-22 | 2026-09-25 |
| CVE-2026-97366 A security flaw has been discovered in jhen0409 react-native-debugger up to 0.14... |
medium | 6.3 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-97648 A vulnerability was detected in ningzichun student-management-system up to 98760... |
medium | 4.3 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-88370 libconfini 1.16.4 contains a heap out-of-bounds write condition involving the bu... |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-93030 FTM 4.x ALL could allow a remote authenticated attacker to obtain sensitive info... |
medium | 6.5 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-79319 Stencil core 4.43.5 is vulnerable to Incorrect Access Control. |
medium | 5.3 | — | — | 2026-09-21 | 2026-09-25 |
| CVE-2026-97649 A flaw has been found in ningzichun student-management-system up to 98760f5711cf... |
medium | 4.7 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-97225 A flaw has been found in DbGate up to 7.2.5-beta.5. |
medium | 6.3 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-97325 A security flaw has been discovered in YunaiV/zhijiantianya ruoyi-vue-pro up to... |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-25 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.