September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,152
Critical
1,210
High
4,303
Medium
4,042
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-96430 Exposed Dangerous Method or Function in the
/WebAgenda/SQLWin.do API endpoint of... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-96431 Unrestricted Upload of File with Dangerous Type in the
/WebAgenda/download/uploa... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-95832 Improper Neutralization of Special Elements in Output Used by a Downstream Compo... |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-80430 Improper Link Resolution Before File Access in the drag source staging path of t... |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-80431 Out-of-bounds Write in the natural width branch of the text sizing protocol in k... |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-80432 Missing Authorization in the drop handling path of the drag and drop protocol in... |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-95834 Use After Free in the drag source path of the drag and drop protocol in kitty fr... |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-95835 Missing Authorization in the askpass escape code handler in kitty from 0.25.0 be... |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-91154 Missing Authentication for Critical Function (CWE-306) in the product cache reva... |
not reported | — | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-101266 A logic flaw in the checkout flow allows users to bypass validations performed d... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-101267 A missing permission check allowed low-privileged users with access to an event... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-101268 If an attacker is able to convince a victim on a specially crafted link, the vic... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-101269 The mechanism binding API-uploaded files to the uploader's authentication method... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-101270 Malicious HTML content could be injected into the help texts of various fields w... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-101271 OAuth credentials (access tokens) are valid for the entirety of their lifetime,... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-101169 In affected versions of Octopus Server, an authenticated user with permissions t... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-84463 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-56734 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-63205 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-63216 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-56725 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-56730 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-85417 Incomplete property masking in the SANnav logging subsystem permits SNMP authent... |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-84465 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-63006 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-63207 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-84460 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-102729 `gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for,... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-53459 Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D p... |
not reported | — | — | — | 2026-09-15 | 2026-09-29 |
| CVE-2026-63131 OpenBao is an open source identity-based secrets management system. |
not reported | — | — | — | 2026-09-23 | 2026-09-29 |
| CVE-2026-63132 OpenBao is an open source identity-based secrets management system. |
not reported | — | — | — | 2026-09-23 | 2026-09-29 |
| CVE-2026-77285 OpenBao is an open source identity-based secrets management system. |
not reported | — | — | — | 2026-09-23 | 2026-09-29 |
| CVE-2026-55214 GLPI is a free asset and IT management software package. |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-71483 Horilla is an HR and CRM software. |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-49469 GLPI is a free asset and IT management software package. |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-53610 GLPI is a free asset and IT management software package. |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-89136 When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2... |
not reported | — | — | — | 2026-09-27 | 2026-09-29 |
| CVE-2026-19915 A potential security vulnerability has been identified in the HP Support Assista... |
not reported | — | — | — | 2026-09-22 | 2026-09-29 |
| CVE-2026-101041 The account recovery (password reset) functionality in the vulnerability-lookup... |
not reported | — | — | — | 2026-09-27 | 2026-09-29 |
| CVE-2026-55473 HomeBox is a home inventory and organization system. |
not reported | — | — | — | 2026-09-21 | 2026-09-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.