September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-54167 Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in s... |
high | 8.2 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55225 Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift... |
high | 8.0 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-76820 OpenCTI is an open source platform for managing cyber threat intelligence knowle... |
high | 7.7 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-84997 react/http is an event-driven, streaming HTTP client and server implementation f... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-59974 Stanza is a Stanford NLP Python library for tokenization, sentence segmentation,... |
high | 7.8 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-63126 Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. |
high | 7.5 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-81875 HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare i... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-81876 HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare i... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-85721 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-54253 TS3 Manager is modern web interface for maintaining Teamspeak3 servers. |
high | 8.2 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-50125 MKP is a Model Context Protocol server for Kubernetes. |
high | 7.5 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-54596 ITFlow provides an IT documentation, ticketing and accounting system for small m... |
high | 8.1 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-61833 zot is a container image and artifact registry based on the Open Container Initi... |
high | 8.1 | — | — | 2026-09-18 | 2026-09-30 |
| CVE-2026-62279 LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel... |
high | 7.1 | — | — | 2026-09-18 | 2026-09-30 |
| CVE-2026-63330 Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. |
high | 7.7 | — | — | 2026-09-21 | 2026-09-30 |
| CVE-2026-59990 Jawn is an open source JSON parser. |
high | 7.5 | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-61814 Jawn is an open source JSON parser. |
high | 7.5 | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-76087 Formie is a Craft CMS plugin for creating forms. |
high | 8.2 | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-76089 Formie is a Craft CMS plugin for creating forms. |
high | 7.7 | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-61816 zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* funct... |
high | 7.5 | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-97735 ITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/tick... |
high | 8.0 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-97737 In Wakapi before 2.17.6, the user caching service allows a lookup to be resolved... |
high | 7.4 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-97875 Rojo's "rojo serve" HTTP API (default port 34872) has no Host/Origin header vali... |
high | 8.1 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-52622 An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal... |
high | 7.5 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-79153 Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access contr... |
high | 7.8 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-88421 Incorrect access control in the BlogPage.get_entries() component of APSL puput v... |
high | 7.5 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-100389 GestSup versions before 3.2.62 contain a remote code execution vulnerability in... |
high | 8.1 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-100390 Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the... |
high | 7.4 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-100520 Laranode versions before 1.2.1 contain a path traversal vulnerability in the POS... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-101032 navi through 2.24.0 fails to properly escape cheatsheet variable values when sub... |
high | 7.0 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-101059 utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote O... |
high | 7.1 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-101060 python-utcp versions before 1.1.4 contain a server-side request forgery vulnerab... |
high | 8.2 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-93348 Unsloth Zoo versions 2025.9.9 before 2026.8.14, as implemented in Unsloth 2025.9... |
high | 8.1 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-102422 shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by... |
high | 8.1 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2015-20122 Seeyon A6 collaborative office automation platform contains an unauthenticated S... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102810 Marmite through 0.4.2 contains a path traversal vulnerability in the development... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102811 Marmite through 0.4.2 contains missing authentication in the development server... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102878 mcp-chrome-bridge through 1.0.31 contains an origin validation error in the nati... |
high | 8.1 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-103054 AiSOC versions before 12.0.0 contain an authorization bypass vulnerability in th... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-10764 Information disclosure in BVMS 4.5 up to 12.3 including allows man-in-the-middle... |
high | 8.7 | — | — | 2026-09-30 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.