September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,152
Critical
1,210
High
4,303
Medium
4,042
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-97259 Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-92103 Allocation of Resources Without Limits or Throttling vulnerability in elixir-min... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-103389 MISP contains a stored cross-site scripting (XSS) vulnerability in the galaxy ic... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103388 MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whene... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102371 In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as roo... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102252 A path traversal vulnerability (CWE-22) in the embedded VMDK filesystem extracto... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102508 Improper Verification of Cryptographic Signature and Improper Certificate Valida... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102509 Memory Allocation with Excessive Size Value, Allocation of Resources Without Lim... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102510 Integer Overflow, Improper Validation of Array Index, Uncontrolled Recursion and... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103012 Claude Code selected an API key stored by Claude Code, for example from an earli... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103235 MISP contains a mass assignment vulnerability in the event delegation feature. |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96342 Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94194 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-7170 Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoin... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-7171 Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoin... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-7172 Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoin... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-81867 A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Goog... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-103321 MISP contains a stored cross-site script (XSS) vulnerability in the event graph... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-86066 Horilla is an HR and CRM software. |
not reported | — | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-48482 GLPI is a free asset and IT management software package. |
not reported | — | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-53626 GLPI is a free asset and IT management software package. |
not reported | — | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-53628 GLPI is a free asset and IT management software package. |
not reported | — | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-96874 Improper neutralization of input during web page generation ('cross-site scripti... |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-96875 Improper neutralization of input during web page generation ('cross-site scripti... |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-96876 Improper neutralization of input during web page generation ('cross-site scripti... |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-96877 Improper neutralization of input during web page generation ('cross-site scripti... |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-96878 Improper neutralization of input during web page generation ('cross-site scripti... |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-96879 Improper removal of sensitive information before storage or transfer vulnerabili... |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-102759 NetX Secure TLS accepts an empty application-data record without verifying its m... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102760 When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on a... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-11796 Asset Suite allows unauthenticated users to access PropertiesReloadServlet, Cach... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-7395 Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-87723 In Google fuse-archive versions prior to 1.24, an attacker who can prepend a dir... |
not reported | — | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-19759 An Incorrect Authorization vulnerability in the task configuration in Google Clo... |
not reported | — | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-81375 A Confused Deputy vulnerability in the EmailTask component in Google Cloud Appli... |
not reported | — | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-102242 Improper link resolution (CWE-59 / CWE-22) in the allowedLocalRoots path validat... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-7192 A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi miniro... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-7193 A vulnerability relating to the use of predefined credentials in the Dbit T-CPE3... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-96428 SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-96429 SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API
endpoint of Flowring... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.