September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-55691 The EmbedVideo Extension is a MediaWiki extension which adds a parser function c... |
high | 8.6 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55692 The EmbedVideo Extension is a MediaWiki extension which adds a parser function c... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-58200 Payload Plugins is a collection of plugins designed to enhance Payload CMS. |
high | 7.1 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-59160 Yeger is a monorepo for npm packages maintained under the yeger scope. |
high | 8.8 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54547 Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants ru... |
high | 7.4 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54549 Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants ru... |
high | 8.3 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-56825 Shopper is a Headless e-commerce Admin Panel. |
high | 8.1 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-56827 Shopper is a Headless e-commerce Admin Panel. |
high | 8.1 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-56829 Shopper is a Headless e-commerce Admin Panel. |
high | 8.1 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-58483 mcp-searxng is a Model Context Protocol server that gives AI assistants web sear... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-58485 mcp-searxng is a Model Context Protocol server that gives AI assistants web sear... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-61668 DIRAC is an interware, meaning a software framework for distributed computing. |
high | 8.1 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54544 Fireshare facilitates self-hosted media and link sharing. |
high | 7.2 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-61554 emp3r0r is a C2 designed by Linux users for Linux environments. |
high | 7.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-88065 `tts-be` is a backend for a timetable selector that aims to help students better... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-61590 djust provides Phoenix LiveView-style reactive server-side rendering for Django... |
high | 7.4 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-63127 RMCP is an official Rust SDK for the Model Context Protocol. |
high | 8.2 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-63128 RMCP is an official Rust SDK for the Model Context Protocol. |
high | 7.5 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-61593 djust provides Phoenix LiveView-style reactive server-side rendering for Django... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-61595 djust provides Phoenix LiveView-style reactive server-side rendering for Django... |
high | 7.7 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-63506 Tina is a headless content management system. |
high | 8.8 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-61591 djust provides Phoenix LiveView-style reactive server-side rendering for Django... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-61592 djust provides Phoenix LiveView-style reactive server-side rendering for Django... |
high | 7.4 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-61596 djust provides Phoenix LiveView-style reactive server-side rendering for Django... |
high | 7.1 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-77614 Opencast is a free, open-source platform to support the management of educationa... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-54446 NetLicensing MCP Server is a natural-language interface that enables agentic app... |
high | 8.1 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-52727 lxc-ci contains continuous integration and image-build scripts for LXC. |
high | 7.2 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-52851 Traccar is an open source GPS tracking system. |
high | 7.1 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-54504 MCP Documentation Server is a local-first document management and semantic searc... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-63443 Coder allows organizations to provision remote development environments via Terr... |
high | 8.3 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-68904 node-opcua is an OPC UA implementation for TypeScript and Node.js. |
high | 7.0 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-85756 SSH.NET is a Secure Shell (SSH) library for .NET. |
high | 7.5 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-85715 ExifReader is a JavaScript Exif information parser. |
high | 7.5 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-86038 libp2p is a JavaScript implementation of the libp2p networking stack. |
high | 7.5 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-100841 In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the... |
high | 7.8 | — | Project-monai / monai | 2026-09-27 | 2026-09-30 |
| CVE-2026-100842 MONAI through 1.6.0 contains an eval injection vulnerability in _get_fake_spatia... |
high | 8.8 | — | Project-monai / monai | 2026-09-27 | 2026-09-30 |
| CVE-2026-50270 dd-trace-java is a Datadog APM client for Java. |
high | 7.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-53752 docx4j is an open source Java library for creating, editing, and saving OpenXML... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-55253 LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and L... |
high | 7.7 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-53714 Envoy Gateway is an open source project for managing Envoy Proxy as a standalone... |
high | 7.4 | — | — | 2026-09-14 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.