September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-77070 n8n before 1.123.69, 2.33.4, and 2.34.1 contains a NoSQL injection vulnerability... |
critical | 9.8 | — | N8n / n8n | 2026-08-20 | 2026-09-01 |
| CVE-2026-77071 n8n before 1.123.69, 2.33.4, and 2.34.1 contains a PostgREST filter injection vu... |
critical | 9.8 | — | N8n / n8n | 2026-08-20 | 2026-09-01 |
| CVE-2026-65081 NVIDIA NemoClaw for Linux contains a vulnerability in its installation process,... |
critical | 9.8 | — | Nvidia / nemoclaw | 2026-08-25 | 2026-09-01 |
| CVE-2026-65098 NVIDIA NemoClaw for Linux contains a vulnerability in its remote-access helper w... |
critical | 9.8 | — | Nvidia / nemoclaw | 2026-08-25 | 2026-09-01 |
| CVE-2019-3774 Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were... |
critical | 9.8 | — | Broadcom / spring batch | 2019-01-18 | 2026-09-01 |
| CVE-2026-65084 NVIDIA NemoClaw for Linux contains a vulnerability in its deployment process, wh... |
critical | 9.8 | — | Nvidia / nemoclaw | 2026-08-25 | 2026-09-01 |
| CVE-2026-18808 Improper Control of Generation of Code ('Code Injection') vulnerability in Klems... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-18765 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-18210 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-39932 OpenEMR through 8.2.0 contains a remote code execution vulnerability in the docu... |
critical | 9.1 | — | Open-emr / openemr | 2026-08-03 | 2026-09-01 |
| CVE-2026-101062 Obot before v0.23.0 (affected versions <= v0.22.1) running with OBOT_SERVER_ENAB... |
high | 8.8 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100888 A weakness has been identified in Trusted Domain Project OpenDKIM up to 2.11.0. |
high | 7.3 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-100885 A vulnerability was found in Krayin laravel-crm up to 2.2.4. |
high | 7.3 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-47097 AJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerabi... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97059 DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoad... |
high | 8.2 | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-94954 A stack-based buffer overflow vulnerability exists in the web management interfa... |
high | 8.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-94953 A stack-based buffer overflow vulnerability exists in the web management interfa... |
high | 8.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-86330 An OS command injection flaw was found in the set_hostname_internal function of... |
high | 7.2 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-79403 An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary... |
high | 8.4 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102758 The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-leng... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102521 The decoder in `readFromDataView` in lib0 before 0.2.119 can be tricked into rea... |
high | 8.6 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-100669 Grav before 2.0.25 ships web server configuration samples whose access-control d... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100673 The Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 th... |
high | 8.2 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100612 Capgo (capgo.app) through version 12.261.0 contains an incomplete access-control... |
high | 7.2 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100288 Cleartext storage of sensitive information in the database in Devolutions Server... |
high | 7.2 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-100241 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wiki... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-100244 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wiki... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-69275 Use after free in Kernel Streaming WOW Thunk Service Driver allows an authorized... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-69277 Stack-based buffer overflow in Microsoft Local Security Authority Server (lsasrv... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-69292 Double free in Remote Desktop Gateway Service allows an authorized attacker to e... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-76111 Dell PowerStore contains an Incorrect Authorization vulnerability. |
high | 8.8 | — | Dell / powerstoreos | 2026-09-01 | 2026-09-30 |
| CVE-2026-58575 Dell PowerStore contains an Authentication Bypass by Spoofing vulnerability. |
high | 8.8 | — | Dell / powerstoreos | 2026-09-01 | 2026-09-30 |
| CVE-2026-79683 Dell PowerStore contains a Protection Mechanism Failure vulnerability. |
high | 8.8 | — | Dell / powerstoreos | 2026-09-01 | 2026-09-30 |
| CVE-2026-95306 Type confusion in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-92870 A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-90783 MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib l... |
high | 7.8 | — | — | 2026-09-13 | 2026-09-30 |
| CVE-2026-91096 In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminat... |
high | 7.5 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-88816 DBI versions before 1.654 for Perl incorrectly treat numeric values as strings i... |
high | 7.5 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-85644 XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an a... |
high | 7.5 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-67993 basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f contains a l... |
high | 8.8 | — | — | 2026-09-29 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.