September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-101045 Fleet-maintained app install and uninstall scripts for macOS are generated from... |
high | 8.0 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100693 Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation... |
high | 8.4 | — | Gohugo / hugo | 2026-09-26 | 2026-09-30 |
| CVE-2026-100697 Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins... |
high | 8.6 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100617 Cap-go capgo.app fails to validate that principals in channel_permission_overrid... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100618 Capgo (capgo.app) is affected by an authorization flaw in the app icon update pa... |
high | 8.5 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100619 Capgo (capgo.app) blocks direct user inserts into the public.manifest table with... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100623 Capgo (capgo.app) exposes the legacy membership table public.org_users directly... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100625 Capgo (capgo.app) exposes a native build TUS upload proxy (supabase/functions/_b... |
high | 7.1 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100627 Capgo (Cap-go/capgo.app) server backend Supabase functions contain an incorrect... |
high | 8.1 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100387 pgPointcloud through 1.2.5 contains a heap out-of-bounds read vulnerability in d... |
high | 8.1 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-69271 Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attack... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-69269 Integer underflow (wrap or wraparound) in Microsoft Standard XPS allows an autho... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-68897 Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-68892 Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-68890 Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-68889 Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attack... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-81352 Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unautho... |
high | 8.8 | — | Microsoft / web media extensions | 2026-09-08 | 2026-09-30 |
| CVE-2026-49464 NL Portal Backend Libraries provide backend components for Dutch government port... |
high | 8.1 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-49846 libks provides foundational support for signalwire C products. |
high | 7.5 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-59960 Argos JavaScript provides official Argos SDKs for JavaScript. |
high | 7.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54178 backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpa... |
high | 8.1 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54180 backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpa... |
high | 7.6 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54567 Flask-Reuploaded provides file uploads for Flask. |
high | 7.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-55091 flat-to-nested converts a hierarchy from a flat representation to a nested repre... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-73494 blaze is a Scala library for building asynchronous pipelines, with a focus on ne... |
high | 7.4 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54447 garminconnect is a Python 3 API wrapper for Garmin Connect that retrieves statis... |
high | 8.4 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54628 Anyquery is an SQL query engine built on top of SQLite. |
high | 8.6 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54629 Anyquery is an SQL query engine built on top of SQLite. |
high | 7.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54632 SIPSorcery is a WebRTC, SIP, and VoIP library for C# and .NET. |
high | 7.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-73496 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 7.7 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-53957 Contentful MCP Server is a Model Context Protocol server for the Contentful Mana... |
high | 7.7 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55178 GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and S... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-57586 CodeRAG is a lightweight semantic code search and distillation utility for AI co... |
high | 8.6 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54076 ArcadeDB is a Multi-Model DBMS. |
high | 8.1 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54077 ArcadeDB is a Multi-Model DBMS. |
high | 7.1 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-59965 Payload Plugins is a collection of plugins designed to enhance Payload CMS. |
high | 7.1 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-59973 FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). |
high | 8.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-65831 ArcadeDB is a Multi-Model DBMS. |
high | 7.7 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55149 Vouch Proxy is an SSO and OAuth/OIDC login solution for Nginx using the auth_req... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55690 The EmbedVideo Extension is a MediaWiki extension which adds a parser function c... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.