September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-88024 Improper neutralization of special elements in data query logic in the GridFS co... |
high | 8.3 | — | Mongodb / rust driver | 2026-09-10 | 2026-09-29 |
| CVE-2026-56198 Out-of-bounds read in Microsoft Trace Data Helper allows an authorized attacker... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-29 |
| CVE-2026-68828 Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attac... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-68850 Heap-based buffer overflow in Microsoft Account allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-29 |
| CVE-2026-88025 Improper neutralization of special elements in data query logic in the GridFS co... |
high | 8.3 | — | Mongodb / c\# driver | 2026-09-10 | 2026-09-29 |
| CVE-2026-88774 Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. |
high | 7.2 | — | Citrix / netscaler application delivery controller | 2026-09-27 | 2026-09-29 |
| CVE-2026-84990 ntopng is a web-based network traffic monitoring application. |
high | 8.8 | — | — | 2026-09-21 | 2026-09-29 |
| CVE-2026-82379 Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacke... |
high | 7.7 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-102004 Wind River VxWorks 7 prior to 26.09, specific system call arguments can result i... |
high | 7.8 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-88027 Improper neutralization of special elements in data query logic in the embedded-... |
high | 8.1 | — | Mongodb / laravel mongodb | 2026-09-10 | 2026-09-29 |
| CVE-2026-88029 Improper neutralization of special elements in data query logic in the GridFS co... |
high | 8.3 | — | Mongodb / python driver | 2026-09-10 | 2026-09-29 |
| CVE-2026-68885 Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-88030 Improper neutralization of special elements in data query logic in the GridFS co... |
high | 8.3 | — | Mongodb / ruby driver | 2026-09-10 | 2026-09-29 |
| CVE-2026-88031 Improper neutralization of special elements in data query logic in the GridFS co... |
high | 8.1 | — | Mongodb / go driver | 2026-09-10 | 2026-09-29 |
| CVE-2026-68888 Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-69378 Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attac... |
high | 7.5 | — | Microsoft / exchange server | 2026-09-08 | 2026-09-29 |
| CVE-2026-65178 NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a mal... |
high | 7.8 | — | Nvidia / nemo speech | 2026-09-22 | 2026-09-29 |
| CVE-2026-65179 NVIDIA NeMo contains a vulnerability in the TabularTokenizer class where it dese... |
high | 8.8 | — | Nvidia / nemo speech | 2026-09-22 | 2026-09-29 |
| CVE-2026-77242 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 7.5 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-77243 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 8.8 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-82348 Authorization Bypass Through User-Controlled Key in Apache Roller 6.1.5 allows a... |
high | 7.7 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-82376 Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 all... |
high | 7.7 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-82386 Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 all... |
high | 7.7 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-69380 Missing authorization in Microsoft Exchange Server allows an authorized attacker... |
high | 8.1 | — | Microsoft / exchange server | 2026-09-08 | 2026-09-29 |
| CVE-2026-69401 Use after free in Audio Video Control Transport Protocol allows an authorized at... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-29 |
| CVE-2026-69407 Integer overflow or wraparound in Volume Manager Driver allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-69418 Heap-based buffer overflow in Volume Manager Driver allows an authorized attacke... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-69432 Heap-based buffer overflow in Volume Manager Driver allows an authorized attacke... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-69438 Incorrect conversion between numeric types in Microsoft JScript allows an unauth... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-55159 luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for Ope... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-29 |
| CVE-2026-77258 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 7.7 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-6935 IBM Concert 1.0.0 through 3.0.0 invokes operating system commands without fully... |
high | 7.8 | — | Ibm / concert | 2026-09-23 | 2026-09-29 |
| CVE-2026-69485 Use of uninitialized resource in Remote Desktop Client allows an authorized atta... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-77260 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 7.5 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-69516 Use after free in Connected Devices Platform Service (Cdpsvc) allows an authoriz... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-29 |
| CVE-2026-69530 Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unautho... |
high | 8.1 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-29 |
| CVE-2026-77255 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 8.6 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-69384 Null pointer dereference in Virtual Hard Disk (VHD) Miniport Driver allows an un... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-77259 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 7.7 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-57223 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.0 | — | Oisf / suricata | 2026-09-18 | 2026-09-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.