September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,152
Critical
1,210
High
4,303
Medium
4,042
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-45794 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-50166 Kuma is a modern Envoy-based service mesh that can run on every cloud across bot... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-52724 Kuma is a modern Envoy-based service mesh that can run on every cloud across bot... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-53966 XWiki Platform is a generic wiki platform. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55701 The OpenTelemetry Collector Contrib repository contains components for the OpenT... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-44778 Inspektor Gadget is a set of tools and framework for data collection and system... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-53658 Fabric CA is a Certificate Authority for Hyperledger Fabric. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-44300 OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-53941 Inspektor Gadget is a set of tools and framework for data collection and system... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-76821 OpenCTI is an open source platform for managing cyber threat intelligence knowle... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-59823 LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) fo... |
not reported | — | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-81869 OpenTelemetry-Go is the Go implementation of OpenTelemetry. |
not reported | — | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-81872 OpenTelemetry-Go is the Go implementation of OpenTelemetry. |
not reported | — | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-79752 CakePHP is a rapid development framework for PHP. |
not reported | — | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-54649 punchin-email is a Cloudflare Email Worker that provides two-way role aliases wh... |
not reported | — | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-55062 uniget is a universal installer and updater for (container) tools. |
not reported | — | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-63199 Perses is an open-source dashboard and visualization project for observability d... |
not reported | — | — | — | 2026-09-18 | 2026-09-30 |
| CVE-2026-77582 Tinyauth is an authentication and authorization server. |
not reported | — | — | — | 2026-09-21 | 2026-09-30 |
| CVE-2026-61541 Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of... |
not reported | — | — | — | 2026-09-21 | 2026-09-30 |
| CVE-2026-93421 Mesop is a Python-based UI framework that allows users to build web applications... |
not reported | — | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-59980 hpack is an HTTP/2 Header Encoding for Python. |
not reported | — | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-61604 The ixo Blockchain is a Layer 1 blockchain that runs on both Testnet and Mainnet... |
not reported | — | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-61742 DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB,... |
not reported | — | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-27867 An attacker with access via network to the Regesta Smart HD-PLC of the provider... |
not reported | — | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-100248 The Rattadan Cosmowarp smart contract before 56c6147 can have a comparison to an... |
not reported | — | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-81871 OpenTelemetry-Go is the Go implementation of OpenTelemetry. |
not reported | — | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-54355 MapServer is a system for developing web-based GIS applications. |
not reported | — | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-4034 Injection Vulnerability in Tibco Administrator version 5.13.0 & prior allows an... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-13087 Rejected reason: This CVE was reserved in error and duplicates CVE-2026-89530. |
not reported | — | — | — | 2026-09-22 | 2026-09-30 |
| CVE-2026-103239 MISP contains a privilege escalation vulnerability in the tag collection creatio... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102511 Improper Verification of Source of a Communication Channel in the ADS discovery... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-92284 Caddy is an extensible server platform that uses TLS by default. |
not reported | — | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-92700 Caddy is an extensible server platform that uses TLS by default. |
not reported | — | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-91860 A prototype pollution vulnerability exists in the deep merge helpers of Vaadin C... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-93547 A missing authorization check in the Vaadin Spreadsheet component allows an auth... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-95509 Strings optimized for Latin-1 displaying Latin-1 characters cause incorrect Stri... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-103441 Deserialization of untrusted data vulnerability in The Wikimedia Foundation Medi... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103442 External control of system or configuration setting vulnerability in The Wikimed... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97685 An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surve... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-96440 Improper Limitation of a Pathname to a Restricted
Directory（Path Traversal） in... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.