September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-95309 UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95307 UI misrepresentation in ExtensionsMenu in Google Chrome prior to 154.0.8037.57 a... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-92869 An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an aut... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94029 Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 t... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-91095 In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWeb... |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-92868 An improper certificate validation vulnerability exists in Pgpool-II, which may... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-88815 DBI versions before 1.654 for Perl incorrectly treat numeric values as strings i... |
medium | 6.2 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-71974 U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in read_... |
medium | 4.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-55174 UltrafastSecp256k1 is a high-performance, multi-backend secp256k1 engine with re... |
medium | 5.9 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103233 A security vulnerability has been detected in AdithyaYelloju Restaurant-Manageme... |
medium | 6.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103399 A flaw was found in SoupServer (libsoup). |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102991 Mako is a template library written in Python. |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102877 Fider before 0.38.0 contains a server-side request forgery vulnerability due to... |
medium | 4.4 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102821 Russh is a Rust SSH client and server library. |
medium | 6.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-53769 Avo is a framework to create admin panels for Ruby on Rails apps. |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-30 |
| CVE-2026-54054 Transmute is a free, open-source, self-hosted file conversion and compression to... |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-30 |
| CVE-2026-49462 NL Portal Backend Libraries provide backend components for Dutch government port... |
medium | 5.3 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-49463 NL Portal Backend Libraries provide backend components for Dutch government port... |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-45057 matrix-sdk-ui provides GUI-centric utilities on top of matrix-rust-sdk. |
medium | 4.9 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-54248 Doco-CD is a GitOps continuous delivery tool that automatically deploys and upda... |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-53708 ContextForge is an AI gateway, registry, and proxy that provides centralized dis... |
medium | 6.6 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-55236 langgraph-api implements the LangGraph API for rapid development and testing. |
medium | 5.9 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54176 backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpa... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54723 devpi is a Python package index staging server and packaging, testing, and relea... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-55832 Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolk... |
medium | 6.1 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-57570 backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpa... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54461 Habitica is a habit tracker application that treats goals like a role-playing ga... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-93405 Mailspring is a fast, cross-platform, open-source email client. |
medium | 6.1 | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-62286 Dozzle is a realtime log viewer for docker containers. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-55156 Token Optimizer MCP measures token savings per AI coding agent, optimizes contex... |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101914 @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, wi... |
medium | 6.5 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-100370 DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. |
medium | 4.7 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-102277 The brace-expansion library generates arbitrary strings containing a common pref... |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-95294 UI misrepresentation in Browser in Google Chrome prior to 154.0.8037.57 allowed... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95296 Missing authorization in Core in Google Chrome on on Mac prior to 154.0.8037.57... |
medium | 4.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95305 UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allow... |
medium | 4.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-54529 SQLAdmin is a flexible Admin interface for SQLAlchemy models. |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-53496 ExifReader is a JavaScript Exif information parser. |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-77420 JLine is a Java library for handling console input. |
medium | 5.5 | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-97222 A heap use-after-free flaw was found in Gnumeric. |
medium | 5.5 | — | — | 2026-09-25 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.