September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,152
Critical
1,210
High
4,303
Medium
4,042
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-82405 Klever-Go is the Go implementation of the Klever blockchain protocol. |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-82406 Klever-Go is the Go implementation of the Klever blockchain protocol. |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-82409 Klever-Go is the Go implementation of the Klever blockchain protocol. |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-63628 mppx is a TypeScript interface for machine payments protocol. |
not reported | — | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-5695 Arbitrary file upload vulnerability due to a lack of proper validation in upload... |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-5696 Reflected Cross-Site Scripting (XSS) in Microweber. |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-7169 a vulnerability involving an unchecked search path element in Evope Collector, v... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97168 Rejected reason: it is a suggestion |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-57168 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-92692 Sulu is an open-source PHP content management system based on the Symfony framew... |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-92730 LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vu... |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-90900 Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefron... |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-90903 Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Admin... |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-90904 Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiCon... |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-90905 Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Conf... |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-90899 Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Gue... |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-85055 Twenty is an open-source CRM (customer relationship management) platform. |
not reported | — | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-82407 Klever-Go is the Go implementation of the Klever blockchain protocol. |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-76910 Unleash is an open-source feature management platform. |
not reported | — | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-54608 MythicalDash is a Pterodactyl client area. |
not reported | — | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-19202 A caching flaw in the toolbox-core package of the mcp-toolbox-sdk-python SDK cau... |
not reported | — | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-55456 Rejected reason: This CVE is a duplicate of another CVE. |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-49865 Kimai is an open-source time tracking application. |
not reported | — | — | — | 2026-09-11 | 2026-09-23 |
| CVE-2026-49992 Kimai is an open-source time tracking application. |
not reported | — | — | — | 2026-09-11 | 2026-09-23 |
| CVE-2026-52819 Kimai is an open-source time tracking application. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-52820 Kimai is an open-source time tracking application. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-52822 Kimai is an open-source time tracking application. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-52823 Kimai is an open-source time tracking application. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-52825 Kimai is an open-source time tracking application. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-52826 Kimai is an open-source time tracking application. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-52828 Kimai is an open-source time tracking application. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-41573 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-44793 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-45051 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-46498 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-47424 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-48717 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-53660 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-62263 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-44203 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.