September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-74225 U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_op... |
high | 7.1 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-61519 Liberu CRM 0.9.1 before 10.0.0 contains a broken access control vulnerability th... |
high | 8.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-103432 apcupsd through 3.14.14 has an sscanf stack-based buffer overflow in getupsvar()... |
high | 8.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103471 restbed through 5.0.0 buffers HTTP request headers without enforcing a maximum s... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103230 A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up... |
high | 7.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102925 virtualenv is a tool for creating isolated virtual python environments. |
high | 7.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102717 MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102253 iperf3 versions prior to 3.22 contains a denial of service vulnerability that al... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-71416 Headroom compresses data before the data reaches a large language model. |
high | 8.8 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-54135 AirSane is a SANE frontend, and a scanner server that supports Apple's AirScan p... |
high | 7.5 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-54166 Shelf is a platform for tracking physical assets. |
high | 7.1 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-54174 melange allows users to build apk packages using declarative pipelines. |
high | 8.3 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-50013 Hoverfly is an open source API simulation tool. |
high | 7.5 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-54240 libde265 is an open source implementation of the h.265 video codec. |
high | 7.4 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-54241 libde265 is an open source implementation of the h.265 video codec. |
high | 7.4 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-57129 PraisonAI is a multi-agent teams system. |
high | 7.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-57579 Alchemy is an open source content management system engine written in Ruby on Ra... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-53659 http4k is a functional toolkit for Kotlin HTTP applications. |
high | 7.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54087 EasyAdmin is a fast and modern admin generator for Symfony applications. |
high | 7.6 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54175 backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpa... |
high | 7.6 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54182 backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpa... |
high | 8.1 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-76086 Formie is a Craft CMS plugin for creating forms. |
high | 8.5 | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-61782 Rsdoctor is a build analyzer tailored for projects built with Rspack. |
high | 7.5 | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-61788 DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB,... |
high | 7.4 | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-57440 The EmbedVideo Extension is a MediaWiki extension which adds a parser function c... |
high | 7.5 | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-61823 code16 Sharp is a Laravel-based framework for building content-management and ad... |
high | 7.3 | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-91837 A flaw was found in NetworkManager-iodine, the iodine VPN plugin for NetworkMana... |
high | 7.8 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-91838 A flaw was found in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager. |
high | 7.8 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-91839 A flaw was found in NetworkManager-fortisslvpn, the FortiSSLVPN plugin for Netwo... |
high | 7.8 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-91840 A flaw was found in NetworkManager-vpnc. |
high | 7.8 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-91841 A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. |
high | 7.8 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-100368 CliInvoke is a .NET library for invoking command-line programs, and its `CliInvo... |
high | 8.4 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-100369 CliInvoke and its formerly named `AlastairLundy.CliInvoke` package are .NET libr... |
high | 8.4 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-57443 SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. |
high | 7.5 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-55160 Stringer is a self-hosted, anti-social RSS reader. |
high | 7.6 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-84894 In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps usin... |
high | 7.5 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-102276 The brace-expansion library generates arbitrary strings containing a common pref... |
high | 7.5 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-63209 compress provides various compression algorithms. |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-79625 Affected products do not properly synchronize access to their monitoring functio... |
high | 8.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-76992 The CODESYS Gateway Client allocates memory based on a size field in a gateway r... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.