September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-102320 Missing authorization in CORS in Google Chrome prior to 154.0.8037.92 allowed a... |
medium | 6.5 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102329 Cross-site scripting in WebUI in Google Chrome prior to 154.0.8037.92 allowed a... |
medium | 6.1 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102330 Incorrect authorization in SiteIsolation in Google Chrome prior to 154.0.8037.92... |
medium | 6.5 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102397 Unauthenticated Broken Access Control in Ultimate Maps by Supsystic <= 1.5.5 ver... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97265 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-93379 Incorrect authorization in ORB in Google Chrome prior to 153.0.8010.52 allowed a... |
medium | 4.3 | — | Google / chrome | 2026-09-17 | 2026-09-30 |
| CVE-2026-93366 Bludit CMS through 3.22.0 contains an authorization bypass vulnerability that al... |
medium | 5.4 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-88860 Capgo fails to clean up channel permission overrides when a user's last organiza... |
medium | 6.3 | — | — | 2026-09-10 | 2026-09-30 |
| CVE-2026-48541 Krayin CRM through 2.2.6 contains a stored client-side template injection vulner... |
medium | 5.4 | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-47603 NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the... |
medium | 5.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-47604 NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the... |
medium | 5.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-47581 NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mod... |
medium | 5.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-47584 NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mod... |
medium | 5.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-47586 NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the... |
medium | 6.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-47568 NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode... |
medium | 5.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-47562 NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode... |
medium | 4.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-47566 NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode... |
medium | 5.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-47567 NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode... |
medium | 5.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-47555 NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the... |
medium | 5.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-47557 NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode... |
medium | 5.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-47549 NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel modul... |
medium | 5.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-47534 NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the... |
medium | 5.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-47526 NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the... |
medium | 4.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-47531 NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the... |
medium | 4.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-47517 NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode... |
medium | 5.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-47506 NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel-mod... |
medium | 5.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-47492 NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the... |
medium | 5.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102847 A flaw has been found in gedelumbung HospitalManagement up to c2d45543789a388706... |
medium | 4.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-100677 stoatchat before 0.15.5 contains an account enumeration vulnerability in the log... |
medium | 5.3 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100689 GitPython before 3.1.62 does not validate the `path` field read from an untruste... |
medium | 5.9 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100621 Capgo (capgo.app) contains an incomplete access-control/content-lock enforcement... |
medium | 4.3 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100611 Capgo (capgo.app backend, versions ≤ 12.261.0) improperly restricts which roles... |
medium | 6.5 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100613 capgo.app is an over-the-air (OTA) update platform for Capacitor apps. |
medium | 5.3 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100306 TDuck survey form through 6.0 fails to validate write passwords on submission en... |
medium | 5.3 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-68891 Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to di... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-50018 Hoverfly is an open source API simulation tool. |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-54258 ZoneMinder is a free, open source closed-circuit television software application... |
medium | 6.5 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-55235 langgraph-api implements the LangGraph API for rapid development and testing. |
medium | 5.9 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-55837 dbt-mcp is a Model Context Protocol server for interacting with dbt. |
medium | 6.8 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-57497 webtransport-go is an implementation of the WebTransport protocol. |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.