September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-103398 OpenSave through 2.4.0 fails to properly validate save paths supplied by paired... |
high | 8.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-81516 Steeltoe is an open source project that provides a collection of libraries that... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-46655 virtio-win provides Windows paravirtualized drivers for QEMU and KVM. |
high | 7.8 | — | — | 2026-09-18 | 2026-09-30 |
| CVE-2026-100310 GNU libextractor before 1.16 loads plugins from an untrusted search path specifi... |
high | 7.0 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-97730 In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File I... |
high | 8.5 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-97731 MinIO through 7aac2a2 does not verify that every x-amz-* header present on a req... |
high | 7.1 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-51773 An issue in the VMware datastore driver of OpenStack glance_store. |
high | 8.1 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-100631 Parse Server is an open source backend server. |
high | 7.5 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100704 Kyverno is a policy engine for Kubernetes. |
high | 7.7 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-101043 pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} envi... |
high | 7.4 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-101044 pacquet, the Rust package-manager component shipped in the pnpm npm package vers... |
high | 7.1 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-93355 LiteLLM contains a weak authentication vulnerability that allows an attacker hol... |
high | 8.1 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101878 Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102566 CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary mod... |
high | 7.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102875 VLC media player before 3.0.24 contains a path traversal vulnerability in the sk... |
high | 7.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-92867 An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an au... |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-92873 Pgpool-II contains an incorrect implementation of an authentication algorithm, w... |
high | 7.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-82538 ILIAS before versions 9.22, 10.10, and 11.3 contains a SQL injection vulnerabili... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-30 |
| CVE-2026-103242 A heap-based buffer overflow flaw was found in rpm. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-62813 Use after free in Active Directory Domain Services allows an authorized attacker... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-62810 Heap-based buffer overflow in Active Directory Certificate Services (AD CS) allo... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-92871 A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97150 When converting baserCMS4-style addons to baserCMS5-style ones,
BcAddonMigrator... |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-71302 The application accepts user-supplied session identifiers and does not regenerat... |
high | 7.1 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-84409 The device's update mechanism retrieves metadata for software updates over an un... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-91191 The device's update mechanism includes conditions that allow unauthorized softwa... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-77422 JLine is a Java library for handling console input. |
high | 7.5 | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-77423 JLine is a Java library for handling console input. |
high | 7.5 | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-71971 U-Boot before 2026.10-rc3 with CONFIG_IP_DEFRAG enabled contains an out-of-bound... |
high | 8.2 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-74220 U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_read_reply() functio... |
high | 8.2 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-74221 U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() fun... |
high | 8.2 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-103229 A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7... |
high | 7.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-95274 Improper output encoding in DevTools in Google Chrome prior to 154.0.8037.57 all... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95276 Improper input validation in Themes in Google Chrome prior to 154.0.8037.57 allo... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-100700 nodemailer before 10.0.6 contains a denial of service vulnerability in the addre... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100372 ClipBucket v5 before 5.5.3-#197 contains a path traversal vulnerability in the a... |
high | 7.2 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-95280 Race condition in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote at... |
high | 7.5 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95286 Type confusion in Bindings in Google Chrome prior to 154.0.8037.57 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102454 EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-95282 Use after free in Platform in Google Chrome prior to 154.0.8037.57 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.