September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-71219 A stack overflow vulnerability was found in gfs2-utils. |
medium | 4.7 | — | Redhat / enterprise linux | 2026-09-03 | 2026-09-22 |
| CVE-2026-84963 An incorrect numeric conversion in the JSON parsing component of the MongoDB C D... |
medium | 5.3 | — | Mongodb / c driver | 2026-09-03 | 2026-09-22 |
| CVE-2026-94094 A flaw has been found in OpenClaw up to 2026.9.5. |
medium | 4.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-94152 A security vulnerability has been detected in Omega Solution FBP Fulfillment by... |
medium | 4.3 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-94032 A flaw has been found in itsourcecode Leave Management System 1.0. |
medium | 6.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-94037 A weakness has been identified in 00Kisumi00 mcp-file-analyzer up to 84740852f0c... |
medium | 4.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-94042 A vulnerability was found in AdithyaYelloju Restaurant Management System up to 7... |
medium | 6.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-94047 A security vulnerability has been detected in samanhappy MCPHub up to 1.0.32. |
medium | 6.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-93954 A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.... |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-22 |
| CVE-2026-93964 A vulnerability was detected in NginxProxyManager nginx-proxy-manager up to 2.15... |
medium | 5.3 | — | — | 2026-09-20 | 2026-09-22 |
| CVE-2026-93311 A vulnerability was detected in Freedesktop Poppler 26.07.0. |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93532 A security vulnerability has been detected in gedelumbung HospitalManagement up... |
medium | 6.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-92475 A weakness has been identified in GPAC 26.08-DEV. |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92880 A weakness has been identified in vgmstream up to r2117. |
medium | 6.3 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92993 A vulnerability was detected in Dromara mayfly-go up to 1.11.5. |
medium | 6.3 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-92365 A vulnerability was found in vllm-project vllm up to 0.29.0. |
medium | 4.3 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92402 A security flaw has been discovered in ChangeWeDer crm up to c07bd4c97141521af64... |
medium | 6.3 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92417 A vulnerability was found in Open5GS up to 2.8.0. |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-92221 A vulnerability was determined in gedelumbung HospitalManagement up to c2d455437... |
medium | 4.7 | — | — | 2026-09-16 | 2026-09-22 |
| CVE-2026-91854 A vulnerability was identified in code-projects Record Management System 1.0. |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-83279 Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Ch... |
medium | 5.5 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-79917 MaxKB is an open-source AI assistant for enterprise. |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-79919 MaxKB is an open-source AI assistant for enterprise. |
medium | 6.3 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-77520 MaxKB is an open-source AI assistant for enterprise. |
medium | 5.4 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-84965 An integer wraparound in an allocation size calculation in the BSON library's JS... |
medium | 5.5 | — | Mongodb / c driver | 2026-09-03 | 2026-09-22 |
| CVE-2026-84966 An incorrect numeric type conversion in the BSON document building component of... |
medium | 5.5 | — | Mongodb / c\+\+ driver | 2026-09-03 | 2026-09-22 |
| CVE-2026-84658 Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBo... |
medium | 4.3 | — | Jenkins / script security | 2026-09-02 | 2026-09-22 |
| CVE-2026-93506 A vulnerability was determined in SveltyCMS 0.0.6. |
medium | 6.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-83419 Vulnerability in the Oracle Communications Cloud Native Core Security Edge Prote... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-83354 Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (compo... |
medium | 6.3 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-77518 MaxKB is an open-source AI assistant for enterprise. |
medium | 5.0 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-77517 MaxKB is an open-source AI assistant for enterprise. |
medium | 5.4 | — | — | 2026-09-21 | 2026-09-22 |
| CVE-2026-84659 Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce... |
medium | 4.3 | — | Jenkins / script security | 2026-09-02 | 2026-09-22 |
| CVE-2026-93314 A vulnerability was determined in Freedesktop Poppler 26.07.0. |
medium | 6.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-93309 A vulnerability was determined in O-RAN-SC SMO OAM 2025-06-10. |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-22 |
| CVE-2026-20516 In MiracastService, there is a possible escalation of privilege due to a confuse... |
medium | 5.5 | — | — | 2026-09-07 | 2026-09-22 |
| CVE-2026-54613 Vvveb is a powerful and easy to use CMS with page builder to build websites, blo... |
medium | 5.4 | — | — | 2026-09-17 | 2026-09-22 |
| CVE-2026-93981 hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a... |
medium | 4.7 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-93955 A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. |
medium | 4.3 | — | — | 2026-09-19 | 2026-09-21 |
| CVE-2026-93965 A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. |
medium | 6.6 | — | — | 2026-09-20 | 2026-09-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.