September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,152
Critical
1,210
High
4,303
Medium
4,042
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84328 Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allo... |
low | 3.1 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84331 Incorrect authorization in Actor in Google Chrome prior to 152.0.7977.75 allowed... |
low | 3.1 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-48932 A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-... |
low | 3.7 | — | — | 2026-09-01 | 2026-09-03 |
| CVE-2026-84437 A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. |
low | 3.5 | — | — | 2026-09-02 | 2026-09-03 |
| CVE-2026-73743 A vulnerability in the web-based management interface of HPE Networking Fabric C... |
low | 3.7 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-03 |
| CVE-2026-73745 A vulnerability in the API endpoint of HPE Networking Fabric Composer could allo... |
low | 3.1 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73744 A denial-of-service vulnerability exists in the web-based management interface o... |
low | 3.5 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73746 A denial-of-service vulnerability exists in the API of HPE Networking Fabric Com... |
low | 3.1 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73747 A local privilege-escalation vulnerability has been discovered in HPE Networking... |
low | 2.5 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-73748 A vulnerability in the affected interface of HPE Networking Fabric Composer allo... |
low | 2.2 | — | Arubanetworks / fabric composer | 2026-09-01 | 2026-09-02 |
| CVE-2026-84438 A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. |
low | 3.5 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-75969 Missing authentication for critical function vulnerability for all PTZOptics cam... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-18825 An Origin Validation Error in the middleware of the connect-xcors npm package al... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-103443 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vu... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103444 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vu... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103445 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vu... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103437 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vu... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103438 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vu... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103439 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vu... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103440 Exposure of sensitive information through data queries vulnerability in The Wiki... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102990 basic-ftp is an FTP client for Node.js. |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102992 piscina is a node.js worker pool implementation. |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102761 NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET`... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102762 The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-55177 CloudTAK is a browser-based Common Operating Picture and situational awareness t... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-55094 Taskcluster is the task execution framework that supports Mozilla's continuous i... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103087 Uncontrolled recursion in the Gosub browser engine (gosub-engine) through 0.1.0... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102938 virtualenv is a tool for creating isolated virtual python environments. |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102984 Astro is a web framework for content-driven websites. |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102829 simple-git, an interface for running git commands in any node.js application, en... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-47680 The source-controller is a Kubernetes operator, specialised in artifacts acquisi... |
not reported | — | — | — | 2026-09-08 | 2026-09-30 |
| CVE-2026-88062 OmniRoute is an open-source AI gateway providing a single endpoint for multiple... |
not reported | — | — | — | 2026-09-10 | 2026-09-30 |
| CVE-2026-49836 psd-tools is a Python package for working with Adobe Photoshop PSD files. |
not reported | — | — | — | 2026-09-10 | 2026-09-30 |
| CVE-2026-54047 Laci Synchroni is a decentralized mod and appearance sync server and plugin for... |
not reported | — | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-48490 ArduinoCore-avr contains the source code and configuration files of the Arduino... |
not reported | — | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-54165 Dobase is an open-source, self-hosted workspace with installable tools. |
not reported | — | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-45056 matrix-sdk-crypto is a no-network-IO implementation of a state machine that hand... |
not reported | — | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-55102 hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. |
not reported | — | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-55451 gettext-converter provides gettext resource conversion utilities for JavaScript. |
not reported | — | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-34151 XWiki Platform is a generic wiki platform. |
not reported | — | — | — | 2026-09-14 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.