September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-53761 Frappe CRM is an open-source customer relationship management tool. |
not reported | — | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-79754 Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. |
not reported | — | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-79756 Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. |
not reported | — | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-84376 Astro is a web framework for content-driven websites. |
not reported | — | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-49249 Boruta is a standalone authorization server that aims to implement OAuth 2.0 and... |
not reported | — | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-53639 Sylius is an Open Source eCommerce Framework on Symfony. |
not reported | — | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-53924 Gardens v2 is a modular governance framework that enables communities to create... |
not reported | — | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-57445 Gardens v2 is a modular governance framework that enables communities to create... |
not reported | — | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-64857 tirreno, a security framework, has a session fixation issue in versions prior to... |
not reported | — | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-67403 Cash Collect contains an improper authorization vulnerability in the Sage AR Aut... |
not reported | — | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-68484 Cash Collect contains an improper authorization vulnerability in the Sage AR Aut... |
not reported | — | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-15140 A privilege-escalation issue in the Portworx Operator when deployed on Red Hat O... |
not reported | — | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-86081 n8n is an open source workflow automation platform. |
not reported | — | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-53758 Emlog is an open source website building system. |
not reported | — | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-80919 In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu:... |
not reported | — | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-80915 In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Fix... |
not reported | — | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-53670 PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation L... |
not reported | — | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-53671 PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation L... |
not reported | — | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-53706 PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation L... |
not reported | — | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-16876 An authentication bypass vulnerability exists in the WebGUI of Series UNIVERGE I... |
not reported | — | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-13148 Missing release of memory after effective lifetime vulnerability in Softing smar... |
not reported | — | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-82911 Cross-Site Request Forgery (CSRF) in the OrderConfirmController at GET /order/co... |
not reported | — | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-78325 Cross-site scripting in the Evernote and Google Keep note importers in Standard... |
not reported | — | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-14297 A buffer overflow in the Bluetooth Continuous Glucose
Monitoring Service (CGMS)... |
not reported | — | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-18796 Any application that
uses external QSPI flash for encrypted XIP on nRF5340 and... |
not reported | — | — | — | 2026-09-07 | 2026-09-09 |
| CVE-2026-19614 The API is prone to XML external entity (XXE) injection. |
not reported | — | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-79989 The vulnerability allows any authenticated user to change their own password wit... |
not reported | — | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-67402 An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/b... |
not reported | — | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-79721 Code execution can occur in versions of the MLflow platform running version 0.0.... |
not reported | — | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-12858 Improper Privilege Management vulnerability in ESET AV Remover (standalone) allo... |
not reported | — | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-87827 Certain KGUARD DVR devices running vulnerable firmware expose a system command e... |
not reported | — | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-12611 A client may issue HTTP/2 requests to a Jetty server that result in blocking wri... |
not reported | — | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-83605 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83606 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83607 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83608 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83609 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83610 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83611 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
| CVE-2026-83612 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser... |
not reported | — | — | — | 2026-09-01 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.