September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-77505 Use after free in DNS Server allows an unauthorized attacker to execute code ove... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-77896 Integer overflow or wraparound in Remote Desktop Client allows an unauthorized a... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-13210 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7... |
high | 7.7 | — | Gitlab / gitlab | 2026-09-15 | 2026-09-28 |
| CVE-2026-19304 IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacke... |
high | 7.7 | — | Langflow / langflow | 2026-09-04 | 2026-09-28 |
| CVE-2026-100663 Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.1... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100671 Grav is a flat-file CMS. |
high | 8.0 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100639 SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gu... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100643 SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View... |
high | 8.0 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100606 Flowise through 3.1.4 (Enterprise/platform mode with SSO enabled) contains an au... |
high | 7.7 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100610 Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/u... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-69498 Use after free in Windows Win32K allows an authorized attacker to elevate privil... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-28 |
| CVE-2026-88765 GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to... |
high | 8.5 | — | Gitlab / gitlab | 2026-09-15 | 2026-09-28 |
| CVE-2026-92470 GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 bef... |
high | 7.7 | — | Gitlab / gitlab | 2026-09-24 | 2026-09-28 |
| CVE-2026-45751 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-10 | 2026-09-28 |
| CVE-2026-45762 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-10 | 2026-09-28 |
| CVE-2026-46387 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-10 | 2026-09-28 |
| CVE-2026-45747 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-10 | 2026-09-28 |
| CVE-2026-63452 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-18 | 2026-09-28 |
| CVE-2026-71418 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-18 | 2026-09-28 |
| CVE-2026-71855 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-18 | 2026-09-28 |
| CVE-2026-93436 vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected... |
high | 7.5 | — | Vllm / vllm | 2026-09-17 | 2026-09-28 |
| CVE-2026-85887 Incorrect permission assignment for critical resource in M365 Copilot allows an... |
high | 7.7 | — | Microsoft / 365 copilot | 2026-09-18 | 2026-09-28 |
| CVE-2026-93592 vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the... |
high | 7.5 | — | Vllm / vllm | 2026-09-18 | 2026-09-28 |
| CVE-2026-63446 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-18 | 2026-09-28 |
| CVE-2026-63447 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-18 | 2026-09-28 |
| CVE-2026-63448 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-18 | 2026-09-28 |
| CVE-2026-46352 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-16 | 2026-09-28 |
| CVE-2026-77605 Notepad++ is a free and open-source source code editor. |
high | 7.8 | — | — | 2026-09-22 | 2026-09-28 |
| CVE-2026-86054 Notepad++ is a free and open-source source code editor. |
high | 7.8 | — | — | 2026-09-22 | 2026-09-28 |
| CVE-2026-86595 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
high | 8.8 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-57178 Python Social Auth is a social authentication/registration mechanism. |
high | 7.4 | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-100707 Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall conte... |
high | 7.7 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100679 stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authent... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100703 Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its... |
high | 7.7 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100607 Flowise through 3.1.4 resolves SSO and local-password users solely by email with... |
high | 7.7 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100567 OpenClaw is an agent gateway distributed as the npm package 'openclaw'. |
high | 8.2 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100579 OpenClaw (npm package 'openclaw') before 2026.7.1 incorrectly trusts requester p... |
high | 7.6 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100587 OpenClaw versions before 2026.7.1 fail to properly validate owner authorization... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100558 OpenClaw versions before 2026.8.1 contain a resource exhaustion vulnerability in... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100530 OpenClaw versions before 2026.8.1 fail to bind working directory context to reus... |
high | 7.3 | — | — | 2026-09-26 | 2026-09-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.