September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-54177 backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpa... |
medium | 6.6 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54181 backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpa... |
medium | 5.4 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-57581 DotVVM is an open source MVVM framework for web applications. |
medium | 5.3 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-55093 Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolk... |
medium | 6.1 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-55244 ASTEVAL is an evaluator of Python expressions and statements. |
medium | 5.0 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-73497 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-49446 Cosmos provides users the ability self-host a home server by acting as a secure... |
medium | 6.1 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55650 Outerbase Studio is a lightweight browser-based database GUI supporting PostgreS... |
medium | 4.4 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-44163 fluent-plugin-opentelemetry is a Fluentd input and output plugin for forwarding... |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-44282 Decidim is a participatory democracy framework. |
medium | 4.8 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-50024 GitHacker is a tool that restores Git repositories from exposed .git directories... |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54724 Kiwi TCMS is an open source test management system. |
medium | 6.1 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55591 Signal K Server is a server application that runs on a central hub in a boat. |
medium | 5.8 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55636 Capsule is a multi-tenancy and policy-based framework for Kubernetes. |
medium | 5.7 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-58196 ToolHive is a utility designed to simplify the deployment and management of Mode... |
medium | 4.7 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-59157 webhookd is a minimalist webhook server that triggers shell scripts and external... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54561 MCP Memory Keeper is an MCP server for persistent context management in AI codin... |
medium | 6.2 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55863 motionEye (mEye) is an online interface for a piece of software called "motion,"... |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-53954 Bugsink is a self-hosted error tracking tool. |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54688 mcp-searxng is a Model Context Protocol server that gives AI assistants web sear... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54689 mcp-searxng is a Model Context Protocol server that gives AI assistants web sear... |
medium | 6.3 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55374 canto-saas-api is a PHP library for interacting with the Canto SaaS API. |
medium | 4.8 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55375 canto-saas-api is a PHP library for interacting with the Canto SaaS API. |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-56830 Shopper is a Headless e-commerce Admin Panel. |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-56831 Shopper is a Headless e-commerce Admin Panel. |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-84993 MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-81176 Svelte devalue is a JavaScript library that serializes values into strings when... |
medium | 5.3 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-61589 djust provides Phoenix LiveView-style reactive server-side rendering for Django... |
medium | 6.3 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-63225 Redocly CLI makes OpenAPI validation, linting, and documentation workflows easie... |
medium | 4.4 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-86000 Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-50157 Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-55846 Allure 2 is the version 2.x branch of Allure Report, a multi-language test repor... |
medium | 6.2 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-55847 Allure 2 is the version 2.x branch of Allure Report, a multi-language test repor... |
medium | 6.1 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-53717 Envoy Gateway is an open source project for managing Envoy Proxy as a standalone... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-53716 Envoy Gateway is an open source project for managing Envoy Proxy as a standalone... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-53719 Envoy Gateway is an open source project for managing Envoy Proxy as a standalone... |
medium | 6.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-62280 Open Access Management (OpenAM) is an access management solution. |
medium | 6.1 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-48722 Nextflow is a DSL for data-driven computational pipelines. |
medium | 5.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54168 Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in s... |
medium | 6.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54503 plone.app.textfield provides a zope.schema-style field type called RichText for... |
medium | 4.3 | — | — | 2026-09-15 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.