September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-6958 Acunetix 25.11.251107123 for Windows contains a local privilege escalation vulne... |
high | 7.8 | — | — | 2026-09-04 | 2026-09-24 |
| CVE-2026-85660 cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the _v... |
high | 8.1 | — | — | 2026-09-04 | 2026-09-24 |
| CVE-2026-85668 Xinference (affected commit 4a94832, v3.x) contains an unauthenticated arbitrary... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-24 |
| CVE-2026-85673 LLaMA-Factory contains a server-side request forgery vulnerability in the OpenAI... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-24 |
| CVE-2026-85675 OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerabi... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-24 |
| CVE-2026-85699 jina-ai reader contains a server-side request forgery vulnerability where URL va... |
high | 7.5 | — | — | 2026-09-04 | 2026-09-24 |
| CVE-2026-86095 Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in... |
high | 7.8 | — | — | 2026-09-04 | 2026-09-24 |
| CVE-2026-86123 SQL Chat contains four unauthenticated API endpoints that accept client-supplied... |
high | 8.7 | — | — | 2026-09-05 | 2026-09-24 |
| CVE-2026-86177 Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in... |
high | 8.8 | — | — | 2026-09-05 | 2026-09-24 |
| CVE-2026-90769 Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sou... |
high | 7.7 | — | — | 2026-09-13 | 2026-09-24 |
| CVE-2026-90772 Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptio... |
high | 7.6 | — | — | 2026-09-13 | 2026-09-24 |
| CVE-2026-90943 parallax filament-comments through 3.0.0 contains a stored cross-site scripting... |
high | 8.7 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-90944 Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint wit... |
high | 8.2 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-91079 Huly Platform through 0.7.426 contains a server-side request forgery vulnerabili... |
high | 8.5 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-91925 Polyaxon through 2.16.4 renders operation specification fields with an unsandbox... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-91988 atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-89425 UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds t... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-91776 TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches th... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-91777 Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jacks... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-13248 An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec... |
high | 8.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-91863 A specially crafted WS-Policy document with deeply nested policy elements can by... |
high | 7.5 | — | Apache / neethi | 2026-09-21 | 2026-09-24 |
| CVE-2026-90554 vLLM versions >=0.10.2 and <0.28.0 do not apply any audio decode-size or duratio... |
high | 7.5 | — | Vllm / vllm | 2026-09-12 | 2026-09-24 |
| CVE-2026-76642 util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit st... |
high | 7.8 | — | — | 2026-09-03 | 2026-09-24 |
| CVE-2026-85396 rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Ent... |
high | 7.5 | — | — | 2026-09-03 | 2026-09-24 |
| CVE-2026-90560 zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerabi... |
high | 8.2 | — | — | 2026-09-12 | 2026-09-24 |
| CVE-2026-81907 Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF)... |
high | 7.1 | — | Concretecms / concrete cms | 2026-09-11 | 2026-09-24 |
| CVE-2026-70579 Out-of-bounds read in Windows Mobile Broadband allows an unauthorized attacker t... |
high | 7.5 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-24 |
| CVE-2026-70578 Heap-based buffer overflow in Windows Credential Guard allows an authorized atta... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-24 |
| CVE-2026-70577 Use after free in Windows Modern Device Management (MDM) allows an authorized at... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-24 |
| CVE-2026-77874 IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.... |
high | 8.6 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-78311 SQL Injection vulnerability in DIAEnergie. |
high | 8.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-79764 Termix is a web-based server management platform with SSH terminal, tunneling, a... |
high | 7.7 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-94611 authentik is an open-source identity provider. |
high | 8.1 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-94612 authentik is an open-source identity provider. |
high | 7.4 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-81455 Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contain a Miss... |
high | 8.6 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-88907 Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Authenti... |
high | 7.4 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-94181 An address bar spoofing issue in affected versions of Arc could allow an attacke... |
high | 7.4 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-94183 Arc Search for Android before version 1.12.10 does not display a fullscreen noti... |
high | 7.4 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-57590 A missing authorization vulnerability exists in the Task Group APIs of Apache Do... |
high | 8.1 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-13465 Stack-based buffer overflow vulnerability in Altera Trusted Firmware on HPS allo... |
high | 8.1 | — | — | 2026-09-24 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.