September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-69351 Exposure of private personal information to an unauthorized actor in Windows Uni... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69353 Out-of-bounds read in Windows Text Shaping allows an authorized attacker to disc... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69343 Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to di... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69321 Missing authentication for critical function in Windows Power Dependency Coordin... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69318 Out-of-bounds read in Windows Imaging Component allows an authorized attacker to... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69297 Storing passwords in a recoverable format in Windows DHCP Server allows an autho... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69286 Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an au... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69288 Use of uninitialized resource in Windows GDI+ allows an authorized attacker to d... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-68898 Out-of-bounds read in Windows iSCSI allows an unauthorized attacker to deny serv... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-68851 Buffer over-read in Windows NTFS allows an authorized attacker to disclose infor... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-68874 Out-of-bounds read in Windows Program Compatibility Assistant Service allows an... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-68833 Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to ex... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-68830 Improper link resolution before file access ('link following') in Windows Univer... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-68831 Files or directories accessible to external parties in Windows Defender Firewall... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-62801 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-61681 Hatchet is a platform for orchestrating background tasks, AI agents, and durable... |
medium | 4.1 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-61748 InvenTree is an Open Source Inventory Management System. |
medium | 4.3 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-61749 InvenTree is an Open Source Inventory Management System. |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-59815 Joplin is an open source note-taking and to-do application that organises notes... |
medium | 4.3 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-58271 Sync-in Server is an open-source platform for file storage, sharing, collaborati... |
medium | 6.8 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-55625 GoCD is a continuous deliver server. |
medium | 4.9 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-54915 Tautulli is a Python based monitoring and tracking tool for Plex Media Server. |
medium | 5.4 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-61709 OpenFGA is an authorization and permission engine built for developers. |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-61588 djust provides Phoenix LiveView-style reactive server-side rendering for Django... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-54551 WireGuard Portal, or wg-portal, is a web-based configuration portal for WireGuar... |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54676 Scoold is a Q&A and a knowledge sharing platform for teams. |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-52852 Traccar is an open source GPS tracking system. |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54565 rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. |
medium | 4.7 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54645 CubeCart is an ecommerce software solution. |
medium | 4.8 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54147 http4k is a functional toolkit for Kotlin HTTP applications. |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-61794 Capsule is a multi-tenancy and policy-based framework for Kubernetes. |
medium | 6.8 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-61795 Capsule is a multi-tenancy and policy-based framework for Kubernetes. |
medium | 6.8 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-63405 AnyCable is a realtime server for reliable two-way communication that supports a... |
medium | 5.9 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-63406 AnyCable is a realtime server for reliable two-way communication that supports a... |
medium | 5.9 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-77386 Kyoo is a self-hosted media server focused on movies, series, and anime. |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-84992 md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-52745 CordysCRM is an open source AI-powered customer relationship management system t... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-61720 FluidSynth is a software synthesizer based on the SoundFont 2 specifications. |
medium | 6.2 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-61723 FluidSynth is a software synthesizer based on the SoundFont 2 specifications. |
medium | 6.8 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-76900 CordysCRM is an open source AI-powered customer relationship management system t... |
medium | 6.8 | — | — | 2026-09-18 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.