September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,152
Critical
1,210
High
4,303
Medium
4,042
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-50025 Mousehole is a background service to update a seedbox IP for MAM and web app to... |
not reported | — | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-55795 Craft Commerce is an ecommerce platform for Craft CMS. |
not reported | — | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54452 safeurl is a server-side request forgery protection library. |
not reported | — | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-52821 Kimai is an open-source time tracking application. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-52824 Kimai is an open-source time tracking application. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-52827 Kimai is an open-source time tracking application. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-47780 free5GC is an open-source implementation of the 5G core network. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-49254 Dragonfly is an open source P2P-based file distribution and image acceleration s... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54254 Cyberdrop-DL is a bulk asynchronous downloader for multiple file hosts. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54637 Dragonfly is an open source P2P-based file distribution and image acceleration s... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55617 Hydro is a next-generation high-performance online judge platform. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54450 ToolHive is a utility designed to simplify the deployment and management of Mode... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55630 Kiwi TCMS is an open source test management system. |
none | 0.0 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55828 qbee transport is a remote access transport protocol implementation. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55864 GeoNetwork is a catalog application to manage spatially referenced resources. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55887 MCP Gateway allows easy and secure running and deployment of MCP servers. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-46488 motionEye (mEye) is an online interface for a piece of software called "motion,"... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-58201 Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54251 netty-incubator-codec-ohttp implements Oblivious HTTP (OHTTP) gateway and client... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-57441 MCPVault is a lightweight Model Context Protocol server for safe access to files... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-57442 MCPVault is a lightweight Model Context Protocol server for safe access to files... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-58502 githubtoplanguages generates a user's top GitHub languages as an SVG. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-32599 Netmaker makes networks with WireGuard. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-61598 djust provides Phoenix LiveView-style reactive server-side rendering for Django... |
not reported | — | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-82410 Pocketbase is an open source web backend written in go. |
not reported | — | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-77360 oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere t... |
not reported | — | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-81870 OpenTelemetry-Go is the Go implementation of OpenTelemetry. |
not reported | — | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-62997 Kedro-Datasets provides data connectors for Kedro. |
not reported | — | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-61597 djust provides Phoenix LiveView-style reactive server-side rendering for Django... |
not reported | — | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-61599 djust provides Phoenix LiveView-style reactive server-side rendering for Django... |
not reported | — | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-61793 Nuxt OG Image generates OG Images with Vue templates in Nuxt. |
not reported | — | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-69197 Umbraco is an ASP.NET CMS. |
not reported | — | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-49292 Kiwi TCMS is an open source test management system. |
none | 0.0 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-54524 Frappe HR is an open-source human resources management solution (HRMS). |
not reported | — | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-47773 ArduinoBLE enables Bluetooth Low Energy connectivity on certain Arduino models. |
not reported | — | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-54559 PocketSphinx is a small speech recognizer. |
not reported | — | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-61549 Woodpecker is a CI/CD engine. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-61544 libp2p-rust is the official Rust language implementation of the libp2p networkin... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-71538 @cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm p... |
not reported | — | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-45052 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.