September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-77897 Relative path traversal in Power Automate allows an authorized attacker to eleva... |
high | 7.0 | — | Microsoft / power automate for desktop | 2026-09-08 | 2026-09-29 |
| CVE-2026-77908 Improper control of generation of code ('code injection') in Microsoft Dynamics... |
high | 8.8 | — | Microsoft / dynamics 365 | 2026-09-08 | 2026-09-29 |
| CVE-2026-69605 Use after free in Microsoft Install Service allows an authorized attacker to ele... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-29 |
| CVE-2026-89099 A race condition in the document value layer of MongoDB Server can allow concurr... |
high | 7.5 | — | Mongodb / mongodb | 2026-09-11 | 2026-09-29 |
| CVE-2026-85921 Double free in Windows Secure Kernel Mode allows an authorized attacker to eleva... |
high | 8.2 | — | Microsoft / windows 11 26h1 | 2026-09-14 | 2026-09-29 |
| CVE-2026-93393 A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C... |
high | 8.1 | — | Mongodb / c driver | 2026-09-17 | 2026-09-29 |
| CVE-2026-97060 X-SpringBoot through 6.0 lacks object-level authorization in user management end... |
high | 7.2 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-101091 SiYuan versions before v3.8.4 fail to properly validate SQL statements in block... |
high | 7.1 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-100692 Hugo is a static site generator. |
high | 7.5 | — | Gohugo / hugo | 2026-09-26 | 2026-09-29 |
| CVE-2026-77581 BentoPDF is a client-side PDF toolkit that is self hostable. |
high | 8.6 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-61825 code16 Sharp is a Laravel-based framework for building content-management and ad... |
high | 8.7 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-77265 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 7.5 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-77262 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 8.6 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-101280 A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. |
high | 7.3 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-101860 A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. |
high | 8.8 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102243 A vulnerability was identified in MODSetter SurfSense up to 2.0.3. |
high | 7.4 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102248 A vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5. |
high | 7.3 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102491 A vulnerability was identified in mahonelau kykms up to 8f130c2d85842d5b44caae78... |
high | 7.3 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-63419 OpenImageIO is a toolset for reading, writing, and manipulating image files of a... |
high | 7.8 | — | Openimageio / openimageio | 2026-09-18 | 2026-09-29 |
| CVE-2026-87748 Missing Authorization vulnerability in Interprobe Information Technologies Inc. |
high | 8.8 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-63422 OpenImageIO is a toolset for reading, writing, and manipulating image files of a... |
high | 7.8 | — | Openimageio / openimageio | 2026-09-18 | 2026-09-29 |
| CVE-2026-63638 OpenImageIO is a toolset for reading, writing, and manipulating image files of a... |
high | 8.3 | — | Openimageio / openimageio | 2026-09-18 | 2026-09-29 |
| CVE-2026-67549 OpenImageIO is a toolset for reading, writing, and manipulating image files of a... |
high | 7.6 | — | Openimageio / openimageio | 2026-09-18 | 2026-09-29 |
| CVE-2026-69611 Use after free in Virtual Hard Disk (VHD) Miniport Driver allows an authorized a... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-65129 NVIDIA Infrastructure Controller for Linux contains a vulnerability where an att... |
high | 8.3 | — | Nvidia / infra controller | 2026-09-22 | 2026-09-29 |
| CVE-2026-63493 Snipe-IT is an IT asset/license management system. |
high | 8.1 | — | Snipeitapp / snipe-it | 2026-09-24 | 2026-09-29 |
| CVE-2026-65117 NVIDIA Infrastructure Controller for Linux contains a vulnerability where an att... |
high | 8.8 | — | Nvidia / infra controller | 2026-09-22 | 2026-09-29 |
| CVE-2026-69365 Out-of-bounds read in Microsoft Local Security Authority Server (lsasrv) allows... |
high | 8.0 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-29 |
| CVE-2026-65124 NVIDIA Infrastructure Controller for Linux contains a vulnerability where an att... |
high | 8.1 | — | Nvidia / infra controller | 2026-09-22 | 2026-09-29 |
| CVE-2026-65125 NVIDIA Infrastructure Controller for Linux contains a vulnerability where an att... |
high | 8.8 | — | Nvidia / infra controller | 2026-09-22 | 2026-09-29 |
| CVE-2026-65126 NVIDIA Infrastructure Controller for Linux contains a vulnerability where an att... |
high | 8.8 | — | Nvidia / infra controller | 2026-09-22 | 2026-09-29 |
| CVE-2026-102634 SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate du... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-65128 NVIDIA Infrastructure Controller for Linux contains a vulnerability where an att... |
high | 8.8 | — | Nvidia / infra controller | 2026-09-22 | 2026-09-29 |
| CVE-2026-88778 Predictable exact value from previous values vulnerability in Citrix NetScaler A... |
high | 7.5 | — | Citrix / netscaler application delivery controller | 2026-09-27 | 2026-09-29 |
| CVE-2026-100557 OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability... |
high | 8.3 | — | — | 2026-09-26 | 2026-09-29 |
| CVE-2026-100561 OpenClaw (npm package 'openclaw') versions >= 2026.3.22 and < 2026.8.1 contain a... |
high | 8.0 | — | — | 2026-09-26 | 2026-09-29 |
| CVE-2026-100570 OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 allow an... |
high | 7.8 | — | — | 2026-09-26 | 2026-09-29 |
| CVE-2026-88022 Improper neutralization of special elements in data query logic in the MongoDB i... |
high | 7.7 | — | Mongodb / laravel mongodb | 2026-09-10 | 2026-09-29 |
| CVE-2026-62368 Snipe-IT is an IT asset/license management system. |
high | 8.4 | — | Snipeitapp / snipe-it | 2026-09-24 | 2026-09-29 |
| CVE-2026-88023 Improper neutralization of special elements in data query logic in the GridFS co... |
high | 8.3 | — | Mongodb / php library | 2026-09-10 | 2026-09-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.