September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100843 MONAI versions before 1.6.0 contain a remote code execution vulnerability in the... |
high | 7.8 | — | Project-monai / monai | 2026-09-27 | 2026-09-30 |
| CVE-2026-100847 AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder... |
high | 7.5 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100850 AzuraCast before 0.23.8 contains a server-side request forgery and local file re... |
high | 7.7 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100744 A flaw has been found in coollabsio Coolify up to 4.1.2. |
high | 7.3 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100835 Contrast before 1.16.0 is susceptible to remote attestation relay attacks. |
high | 7.4 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100690 Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css... |
high | 7.5 | — | Gohugo / hugo | 2026-09-26 | 2026-09-30 |
| CVE-2026-100308 Deserialization of untrusted data in the model loading component in Amazon Gluon... |
high | 7.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-93994 Apache MINA SSHD is a Java library for client-side and server-side SSH. |
high | 8.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94002 Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-100840 MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle... |
high | 7.8 | — | Project-monai / monai | 2026-09-27 | 2026-09-30 |
| CVE-2026-100844 MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner c... |
high | 7.8 | — | Project-monai / monai | 2026-09-27 | 2026-09-30 |
| CVE-2026-93306 IBM Server Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW... |
high | 7.1 | — | Ibm / power system e1080 \(9080-hex\) firmware | 2026-09-25 | 2026-09-30 |
| CVE-2026-100845 MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the Numpy... |
high | 7.8 | — | Project-monai / monai | 2026-09-27 | 2026-09-30 |
| CVE-2026-77762 Concurrent Execution using Shared Resource with Improper Synchronization ('Race... |
high | 8.1 | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-102335 Nginx Proxy Manager through 2.16.0 fails to restrict the advanced_config field t... |
high | 7.1 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-100662 Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100666 Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final thro... |
high | 7.3 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100670 Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100646 SiYuan is a self-hosted personal knowledge management system. |
high | 8.1 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100642 SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery v... |
high | 7.6 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-102317 Improper privilege management in Mojo in Google Chrome on on Windows prior to 15... |
high | 8.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102321 Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102323 Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102324 Use after free in PictureInPicture in Google Chrome prior to 154.0.8037.92 allow... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102326 Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102328 Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95322 Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-97293 Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions. |
high | 8.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97272 Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for Wo... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97250 Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97253 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97271 Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97241 Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions. |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97244 Contributor Path Traversal in Creator LMS <= 1.2.19 versions. |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97245 Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions. |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97197 Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 v... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97235 Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97240 Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96838 Unauthenticated Cross Site Request Forgery (CSRF) in Blacklist Manager – WooComm... |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97065 Unauthenticated Cross Site Scripting (XSS) in Happyforms <= 1.26.15 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.