September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-61551 Icinga 2 is an open source monitoring system. |
high | 8.6 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-61552 Icinga 2 is an open source monitoring system. |
high | 7.2 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-55071 MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safe... |
high | 8.4 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-54647 CubeCart is an ecommerce software solution. |
high | 7.2 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-82399 CoreDNS is a DNS server written in Go. |
high | 7.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-85719 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-50277 dd-trace-cpp is the Datadog distributed tracing library for C++. |
high | 7.5 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-77301 adm-zip is a JavaScript library for creating and extracting ZIP archives in Node... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-69184 c-ares is an asynchronous resolver library. |
high | 7.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-55567 BleachBit cleans files to free disk space and to maintain privacy. |
high | 7.8 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-53940 Conda is a system-level binary package and environment manager that runs on majo... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-88344 An out-of-bounds read vulnerability exists in the schema lexer of flatcc 4c3b999... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-85178 Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/va... |
high | 7.7 | — | — | 2026-09-03 | 2026-09-24 |
| CVE-2026-86119 Webstudio through 0.296.0 contains an unauthenticated server-side request forger... |
high | 8.6 | — | — | 2026-09-05 | 2026-09-24 |
| CVE-2026-89266 stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where... |
high | 8.2 | — | — | 2026-09-12 | 2026-09-24 |
| CVE-2026-91144 ZFile through 5.0.5 fails to validate requested file paths against a share link'... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-91923 KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in... |
high | 7.7 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-91989 atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in the... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-92000 adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output li... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-92602 TDuck survey form through version 5.3 fails to validate webhook URLs or verify f... |
high | 7.1 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-47094 SIMAC MyPHR 1.1 contains an insecure direct object reference (IDOR) vulnerabilit... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92762 Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions onl... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92779 Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pol... |
high | 7.6 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92784 @refinedev/inferencer through 7.0.0 fails to escape API field names when interpo... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92791 Uber Kraken through 0.1.29 fails to validate the tag parameter in the /tags/{tag... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2021-48008 Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-88345 An out-of-bounds read vulnerability exists in the schema lexer of flatcc 4c3b999... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-96271 Photoview through 2.4.0 contains an authorization bypass vulnerability in the sh... |
high | 7.1 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96673 Photoview through 2.4.0 contains an SQL injection vulnerability in the album dow... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96604 A vulnerability was identified in SoftNews Media Group DataLife Engine 18.0. |
high | 7.3 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96751 A vulnerability has been found in pmTicket Project-Management-Software up to 078... |
high | 7.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96762 A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. |
high | 7.3 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97055 SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret (to... |
high | 8.1 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97057 redis-parser through 3.0.0 fails to validate the multi-bulk length value in RESP... |
high | 7.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-51995 An issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to... |
high | 7.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97362 HFS2 version 2.4.0 and earlier contains a denial of service vulnerability that a... |
high | 7.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-88357 nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer de... |
high | 7.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-88368 NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability... |
high | 7.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-88376 Bento4 1.6.0.0 contains an integer underflow vulnerability in AP4_AvccAtom::Crea... |
high | 7.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-88390 An out-of-bounds write vulnerability in jslGetTokenValueAsString() in Espruino 2... |
high | 7.7 | — | — | 2026-09-24 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.