September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,152
Critical
1,210
High
4,303
Medium
4,042
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-55870 GoCD is a continuous deliver server. |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-68956 Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP... |
not reported | — | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-65634 Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER deco... |
not reported | — | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-54577 mport is the MidnightBSD Package Manager. |
not reported | — | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54579 mport is the MidnightBSD Package Manager. |
not reported | — | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54580 mport is the MidnightBSD Package Manager. |
not reported | — | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54642 CubeCart is an ecommerce software solution. |
not reported | — | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-77405 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. |
not reported | — | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-77409 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. |
not reported | — | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-75516 The RabbitMQ Java client library allows Java and JVM-based applications to conne... |
not reported | — | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-54451 Elixir protobuf is a pure Elixir implementation of Google Protobuf. |
not reported | — | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54633 PoDoFo is a C++17 PDF manipulation library. |
not reported | — | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-55563 Feast is the open source feature store for AI and machine learning. |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-61674 Fluent Bit is a fast and lightweight logs, metrics, and traces processor for Lin... |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-68490 Incorrect permission assignment allows local users to obtain sensitive CalDAV/Ca... |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-68492 An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 an... |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-87898 OS command injection in Plesk allows remote authenticated users to execute arbit... |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-87899 Execution with unnecessary privileges in cPanel allows remote authenticated user... |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-87900 Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remo... |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96609 Robur Albatross 1.0.0 through 2.x before 2.7.2 does not limit use of the ring bu... |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-79616 Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Contex... |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-78253 Uncontrolled recursion in QXmlStreamReader::readElementText() in Qt Group Qt all... |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-11744 An input validation vulnerability exists in the PaperCut Hive embedded applicati... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-79680 Authentication bypass vulnerability in the password authentication mechanism of... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-90481 In PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97151 mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97152 Nanomsg versions 0.5-beta through 1.x before 1.2.3 has a remotely exploitable bu... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96269 GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file,... |
not reported | — | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-13016 ServiceNow has remediated a SQL injection vulnerability that was identified in t... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-86858 ServiceNow has remediated an improper access control security issue that was ide... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-86859 ServiceNow has remediated an authorization bypass security issue that was identi... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96770 All published s2s-proxy versions through 0.2.2 are affected. |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-4637 Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a refl... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-4638 PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-12559 A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenTex... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96872 Improper handling of insufficient permissions or privileges vulnerability in The... |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96873 Improper neutralization of input during web page generation ('cross-site scripti... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-63646 CordysCRM is an open source AI-powered customer relationship management system t... |
not reported | — | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-91187 Improper Verification of Cryptographic Signature vulnerability in dashbit nimble... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-94604 Rejected reason: This CVE is a duplicate of another CVE. |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.