September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-55226 Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift... |
medium | 5.4 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-77401 Zope AccessControl provides a general security framework for use in Zope. |
medium | 6.8 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-59944 Composer is a dependency Manager for the PHP language. |
medium | 6.1 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-62949 AsyncSSH is a Python package which provides an asynchronous client and server im... |
medium | 6.5 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-85718 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
medium | 5.9 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-44235 rabbitmq-c is a C-language AMQP client library for RabbitMQ. |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-54546 CloudTAK is a browser-based Common Operating Picture and situational awareness t... |
medium | 5.0 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-94419 Without NO_SESSION_CACHE_REF, wolfSSL_get_session() does not return a session ob... |
medium | 5.4 | — | Wolfssl / wolfssl | 2026-09-27 | 2026-09-30 |
| CVE-2026-54677 Scoold is a Q&A and a knowledge sharing platform for teams. |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-54918 NetBox Device Type Library is a collection of community-sourced device type defi... |
medium | 5.3 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-58272 Sync-in Server is an open-source platform for file storage, sharing, collaborati... |
medium | 5.3 | — | — | 2026-09-21 | 2026-09-30 |
| CVE-2026-61784 xhtml-purifier is a Node.js library to take in raw/unknown/untrusted HTML and ou... |
medium | 6.1 | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-97723 madpsy ka9q_ubersdr before 0.1.58 has a stored cross-site scripting (XSS) vulner... |
medium | 5.4 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-97724 A prototype pollution vulnerability in Software Mansion React Native Worklets be... |
medium | 4.3 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-97732 IRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticate... |
medium | 5.1 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-97736 tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. |
medium | 5.4 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-88420 A reflected cross-site scripting (XSS) vulnerability in the EntryAbstract.save()... |
medium | 5.4 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-88389 Espruino 2v29 (commit bffc6d0) contains a NULL pointer dereference vulnerability... |
medium | 6.2 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-100230 Input Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-dr... |
medium | 5.3 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-101061 utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side reques... |
medium | 4.7 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-102333 httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs... |
medium | 6.1 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-102362 mall4j through 4.0 fails to implement authentication controls on the DELETE /pro... |
medium | 5.3 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102364 mall4j through 4.0 fails to validate the sysType field in sa-token sessions, all... |
medium | 5.4 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102366 mall4j through 4.0 contains an unrestricted file upload vulnerability in FileCon... |
medium | 4.4 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102367 mall4j through 4.0 contains an insufficient session expiration vulnerability in... |
medium | 5.4 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102372 GestSup versions before 3.2.61 fail to properly sanitize HTML email bodies in th... |
medium | 6.1 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102374 GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerabili... |
medium | 6.1 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102507 Sliver C2 framework version 1.7.7 and earlier contains an unhandled panic vulner... |
medium | 5.7 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102568 Pardus Parental Control before 0.7.0 contains an incorrect authorization vulnera... |
medium | 5.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102879 ClaraVerse through 0.3.1 contains server-side request forgery protection bypasse... |
medium | 5.0 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-53989 Dockhand before 1.0.36 contains an open redirect vulnerability in the OIDC initi... |
medium | 4.7 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-79348 KitchenAsty through 0.3.0 contains a broken object level authorization (IDOR) vu... |
medium | 4.3 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-103053 AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the respons... |
medium | 5.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103057 AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerabilit... |
medium | 4.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103396 bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMidd... |
medium | 4.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-85078 Sanic is an opensource python web server/framework. |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-81868 Steeltoe is an open source project that provides a collection of libraries that... |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-85717 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
medium | 6.8 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-93363 The @payloadcms/storage-vercel-blob storage adapter for Payload contains an impr... |
medium | 4.3 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-89102 In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation fl... |
medium | 6.5 | — | Wolfssl / wolfssl | 2026-09-27 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.