September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,141
Critical
1,210
High
4,303
Medium
4,031
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-46623 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-47426 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-77403 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-77404 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-77406 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-77407 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-77408 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-77410 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-77411 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-77412 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-18944 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-54594 OmniBlocks is a monorepo for the OmniBlocks project. |
not reported | — | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-48977 OpenSlide is a C library for reading whole slide image files. |
not reported | — | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-54604 OpenSlide is a C library for reading whole slide image files. |
not reported | — | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-54343 Frappe Learning Management System (LMS) is a learning system that helps users st... |
not reported | — | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-63458 Perses is an open-source dashboard and visualization project for observability d... |
not reported | — | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-63647 CordysCRM is an open source AI-powered customer relationship management system t... |
not reported | — | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-91130 Home Assistant is open source home automation software focused on local control... |
not reported | — | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-63627 mppx is a TypeScript interface for machine payments protocol. |
not reported | — | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-76909 Unleash is an open-source feature management platform. |
not reported | — | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-77426 Unleash is an open-source feature management platform. |
not reported | — | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-12974 A Security Policy Bypass vulnerability exists in Forcepoint Security Engine (NGF... |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-92378 A session management
vulnerability exists in the Legacy UI Reduced Function Logi... |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-53554 SQLBot is an intelligent Text-to-SQL system based on large language models and R... |
not reported | — | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-53555 SQLBot is an intelligent Text-to-SQL system based on large language models and R... |
not reported | — | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-53556 SQLBot is an intelligent Text-to-SQL system based on large language models and R... |
not reported | — | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-53557 SQLBot is an intelligent Text-to-SQL system based on large language models and R... |
not reported | — | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-93769 HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability t... |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-92419 WEBCON BPS is vulnerable to Insecure Direct Object Reference (IDOR) in the /api/... |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-96559 Rejected reason: This ID was for testing |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-19535 Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vul... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-73163 Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Ele... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-73164 Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Ele... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-73165 Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Ele... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-73166 Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-73167 Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Ele... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-73169 Nozomi Networks Labs identified a CWE-79: Improper Neutralization of Input Durin... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-73170 Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-73171 Nozomi Networks Labs identified a CWE-73: External Control of File Name or Path... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-73172 Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Ele... |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.