September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-54339 Glean is a self-hosted RSS reader and personal knowledge management tool. |
high | 7.7 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54597 ITFlow provides an IT documentation, ticketing and accounting system for small m... |
high | 8.3 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54916 NetBox Device Type Library is a collection of community-sourced device type defi... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-68523 `fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that process... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-68537 `fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that process... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-77615 Paella Player is a set of libraries to create a multi stream video player. |
high | 8.7 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-50158 yutu is an AI-powered toolkit for managing and growing YouTube channels. |
high | 7.7 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54519 AI Agent Automation is a modular AI agent workflow automation platform with sche... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54520 AI Agent Automation is a modular AI agent workflow automation platform with sche... |
high | 8.1 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54634 Hamlib is a ham radio control library for radios, rotators, and amplifiers. |
high | 7.3 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54148 http4k is a functional toolkit for Kotlin HTTP applications. |
high | 8.1 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-58197 ToolHive is a utility designed to simplify the deployment and management of Mode... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-61672 Capsule is a multi-tenancy and policy-based framework for Kubernetes. |
high | 7.1 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-32641 Parseable is a log analytics platform built for high-volume data ingestion and a... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-33625 LMDeploy is a toolkit for compressing, deploying, and serving large language mod... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-62278 LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel... |
high | 8.1 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-85058 Moquette is a lightweight Java MQTT broker. |
high | 7.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-91127 File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other... |
high | 8.2 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-68928 Acode is a powerful text and code editor for Android. |
high | 8.6 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-61687 Hatchet is a platform for orchestrating background tasks, AI agents, and durable... |
high | 7.1 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-63116 deepstream is a server that allows clients and backend services to sync data, se... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-77560 Tinyauth is an authentication and authorization server. |
high | 8.1 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-55897 luci-app-advanced-reboot is a LuCI (web interface) application for OpenWrt that... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-88419 An unrestricted upload of files with a dangerous type in the thumbnail-upload en... |
high | 8.8 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-82566 The Botslab G980H dash camera firmware contains a session management vulnerabili... |
high | 8.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-84399 The Botslab G980H dash camera firmware contains an authorization vulnerability i... |
high | 8.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-86003 CoreDNS is a DNS server written in Go. |
high | 7.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-54239 Faust.js is a headless WordPress toolkit. |
high | 8.8 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-85077 Sanic is an opensource python web server/framework. |
high | 8.2 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-81515 Steeltoe is an open source project that provides a collection of libraries that... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-61548 Rsyslog is a rocket-fast system for log processing. |
high | 8.1 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-61817 pg_partman is a PostgreSQL extension that manages partitioned tables by time or... |
high | 8.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-61818 pg_partman is a PostgreSQL extension that manages partitioned tables by time or... |
high | 8.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-61821 pg_partman is a PostgreSQL extension that manages partitioned tables by time or... |
high | 8.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-86039 libp2p is a JavaScript implementation of the libp2p networking stack. |
high | 8.2 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-86040 libp2p is a JavaScript implementation of the libp2p networking stack. |
high | 7.5 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54354 MapServer is a system for developing web-based GIS applications. |
high | 8.2 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-86049 Jupyter Server is the backend for Jupyter web applications. |
high | 7.1 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-62371 KubeEdge is an open source system for extending native containerized application... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-88407 An out-of-bounds read in the node_token_count/relation_token_count component of... |
high | 7.5 | — | — | 2026-09-21 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.