September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,152
Critical
1,210
High
4,303
Medium
4,042
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-49250 Conform, a type-safe form validation library, allows the parsing of nested objec... |
not reported | — | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54150 next-video is a library for adding video to Next.js applications. |
not reported | — | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-57577 DotVVM is an open source MVVM framework for web applications. |
not reported | — | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-57578 DotVVM is an open source MVVM framework for web applications. |
not reported | — | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-52744 GoCD is a continuous deliver server. |
not reported | — | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-56744 `@bsv/wallet-toolbox` provides BRC-100 wallet signing and storage components, wh... |
not reported | — | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-96538 WarehousePG (WHPG) 7.x before 7.6.0-WHPG is affected by a missing authorization... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-48100 Payy is an Ethereum L2 zk-rollup for privacy preserving and regulatory compliant... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101910 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101912 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101913 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-100371 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-100392 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-41875 Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-85520 Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerable to unau... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-68911 Nicotine+ is a graphical client for the Soulseek peer-to-peer network. |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-93853 Unverified ownership in Barman snapshot backup deletion allows a principal who c... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-74864 sogo_yhn configures SOGo with a parameter that forces the request with HTTP head... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-74865 sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94545 Satori is a library to convert HTML and CSS to SVG. |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-80490 Algorithm::AhoCorasick::XS versions through 0.04 for Perl read the haystack stri... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-101898 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101900 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101902 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101903 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101904 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101906 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101907 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101908 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-15390 Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-19547 Ghostscript for Windows is vulnerable to local privilege escalation through Post... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102598 Werkzeug is a comprehensive WSGI web application library. |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-97711 Serialize JavaScript serializes JavaScript values to a superset of JSON that inc... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102930 virtualenv is a tool for creating isolated virtual python environments. |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-10726 Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclos... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-10739 Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102983 Astro is a web framework for content-driven websites. |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103470 In Internet2 Grouper before 7.5.1 (in some configurations), a user who is allowe... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103237 MISP contains an improper input validation vulnerability in its ORM save path. |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-88061 career-ops is an open-source AI-assisted job search and application management t... |
not reported | — | — | — | 2026-09-10 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.