September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,365
Critical
1,230
High
4,374
Medium
4,127
Low
462
Severity not reported
1,172
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-101084 obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-co... |
critical | 9.6 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2025-58371 Roo Code is an AI-powered autonomous coding agent that lives in users' editors. |
critical | 9.8 | — | Roocode / roo code | 2025-09-05 | 2026-09-30 |
| CVE-2025-10068 A flaw has been found in itsourcecode Online Discussion Forum 1.0. |
critical | 9.8 | — | Emiloi / online discussion forum | 2025-09-07 | 2026-09-30 |
| CVE-2025-10091 A vulnerability has been found in Jinher OA up to 1.2. |
critical | 9.8 | — | Jinher / jinher oa | 2025-09-08 | 2026-09-30 |
| CVE-2025-10097 A vulnerability was identified in SimStudioAI sim up to 1.0.0. |
critical | 9.8 | — | Sim / sim | 2025-09-08 | 2026-09-30 |
| CVE-2025-40690 SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. |
critical | 9.8 | — | Phpgurukul / online fire reporting system | 2025-09-11 | 2026-09-30 |
| CVE-2025-10405 A vulnerability was determined in itsourcecode Baptism Information Management Sy... |
critical | 9.8 | — | Itsourcecode / baptism information management system | 2025-09-14 | 2026-09-30 |
| CVE-2025-10479 A security flaw has been discovered in SourceCodester Online Student File Manage... |
critical | 9.8 | — | Janobe / online student file management system | 2025-09-15 | 2026-09-30 |
| CVE-2025-10564 A vulnerability was found in Campcodes Grocery Sales and Inventory System 1.0. |
critical | 9.8 | — | Campcodes / grocery sales and inventory system | 2025-09-16 | 2026-09-30 |
| CVE-2025-10768 A flaw has been found in h2oai h2o-3 up to 3.46.08. |
critical | 9.8 | — | H2o / h2o | 2025-09-21 | 2026-09-30 |
| CVE-2025-10796 A vulnerability was found in code-projects Hostel Management System 1.0. |
critical | 9.8 | — | Angeljudesuarez / hostel management system | 2025-09-22 | 2026-09-30 |
| CVE-2025-10798 A vulnerability was identified in code-projects Hostel Management System 1.0. |
critical | 9.8 | — | Angeljudesuarez / hostel management system | 2025-09-22 | 2026-09-30 |
| CVE-2025-68145 In mcp-server-git versions prior to 2025.12.17, when the server is started with... |
critical | 9.1 | — | Lfprojects / model context protocol servers | 2025-12-17 | 2026-09-30 |
| CVE-2025-14849 Advantech WebAccess/SCADA
is vulnerable to unrestricted file upload, which may... |
critical | 9.8 | — | Advantech / webaccess\/scada | 2025-12-18 | 2026-09-30 |
| CVE-2025-34449 Genymobile/scrcpy versions up to and including 3.3.3, prior to commit 3e40b24, c... |
critical | 9.1 | — | Genymotion / scrcpy | 2025-12-18 | 2026-09-30 |
| CVE-2025-68398 Weblate is a web based localization tool. |
critical | 9.1 | — | Weblate / weblate | 2025-12-18 | 2026-09-30 |
| CVE-2026-79536 bytebase dbhub v1.2.0 was discovered to contain a SQL injection vulnerability in... |
critical | 9.1 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-76721 Buffer overflow vulnerability exists in the affected interface of HPE Networking... |
critical | 9.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102304 Use after free in Passwords in Google Chrome prior to 154.0.8037.92 allowed a re... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-69276 Integer underflow (wrap or wraparound) in Microsoft UxTheme Library (uxtheme.dll... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-95310 Use after free in AdFilter in Google Chrome prior to 154.0.8037.57 allowed a rem... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95311 Free of non-heap memory in Fonts in Google Chrome prior to 154.0.8037.57 allowed... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-62308 Tugtainer is a self-hosted app for automating updates of Docker containers. |
critical | 9.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-95281 Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 a... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-55181 Tugtainer is a self-hosted app for automating updates of Docker containers. |
critical | 9.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-55107 Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applic... |
critical | 10.0 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103475 yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP a... |
critical | 9.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103395 LightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC se... |
critical | 9.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-53952 GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the... |
critical | 9.8 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-61741 http4s-scala-xml provides `EntityDecoder[F, scala.xml.Elem]` instances that pars... |
critical | 9.3 | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-92161 FriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Fac... |
critical | 9.8 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-49994 Bluehood monitors local bluetooth activity. |
critical | 9.1 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-84154 A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Rel... |
critical | 9.9 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-55494 Tugtainer is a self-hosted app for automating updates of Docker containers. |
critical | 9.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-95299 Use after free in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote a... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-101894 The decompress package for Node.js extracts archives. |
critical | 9.1 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-103056 AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in... |
critical | 9.0 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2025-9187 Memory safety bugs present in Firefox 141 and Thunderbird 141. |
critical | 9.8 | — | Mozilla / firefox | 2025-08-19 | 2026-09-30 |
| CVE-2026-59178 ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-100512 Contributor PHP Object Injection in Nested Pages <= 3.3.2 versions. |
critical | 9.8 | — | — | 2026-09-30 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.