September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-102006 In Wind River VxWorks 7 prior to 26.09, specific system call arguments can resul... |
medium | 5.5 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-102384 Author Cross Site Scripting (XSS) in Supreme Modules Lite <= 2.5.63 versions. |
medium | 5.9 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-100508 Unauthenticated Denial of Service Attack in Two Factor <= 0.16.0 versions. |
medium | 5.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-100513 Contributor Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management... |
medium | 6.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102303 Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037... |
medium | 4.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102307 Uninitialized resource in Dawn in Google Chrome on on Android prior to 154.0.803... |
medium | 4.7 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-94282 An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion in libX... |
medium | 5.6 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-94283 An out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute p... |
medium | 6.5 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-94284 An out-of-bounds read vulnerability in libX11's XIM trigger-key registration par... |
medium | 5.5 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-94285 An out-of-bounds read in libX11's byte-oriented codeset parser in libX11 before... |
medium | 5.1 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-100601 ClawHub (openclaw/clawhub) application/backend contains a server-side request fo... |
medium | 5.3 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100609 Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up... |
medium | 6.8 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-69345 Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to di... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-69303 Out-of-bounds read in Push Message Routing Service allows an authorized attacker... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-69308 Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to di... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-69317 Out-of-bounds read in Remote Desktop Client allows an authorized attacker to dis... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-91204 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.1 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-91206 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.1 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-82546 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.1 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-100312 A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project u... |
medium | 6.3 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-63431 Horilla is an HR and CRM software. |
medium | 6.5 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-100577 OpenClaw versions before 2026.8.1 fail to validate video asset URLs returned by... |
medium | 6.3 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100581 OpenClaw for iOS before 2026.8.11 stores Gateway credentials as cleartext JSON i... |
medium | 5.5 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100593 OpenClaw (npm package `openclaw`) before 2026.7.1 does not enforce the documente... |
medium | 5.4 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100556 OpenClaw (npm package openclaw) versions >= 2026.5.2 and < 2026.8.1 contain an i... |
medium | 6.3 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100564 OpenClaw versions before 2026.8.1 fail to neutralize spreadsheet formula charact... |
medium | 5.4 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100569 OpenClaw is an npm-distributed application. |
medium | 5.5 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100536 OpenClaw versions before 2026.8.1 fail to validate all source fields in structur... |
medium | 6.5 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100548 OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 contain a... |
medium | 5.3 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100388 RustDesk versions before 1.5.0 fail to properly validate file transfer permissio... |
medium | 5.4 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-100524 Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the... |
medium | 5.4 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100528 OpenClaw (npm package 'openclaw') before 2026.8.1 could send third-party provide... |
medium | 5.4 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100303 TDuck survey form through 6.0 lacks authorization checks on FormThemeController... |
medium | 5.4 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-88884 Renovate is a dependency update automation tool. |
medium | 5.8 | — | — | 2026-09-10 | 2026-09-29 |
| CVE-2026-100295 In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an internal debug interface... |
medium | 6.3 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-100297 In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an unauthenticated network c... |
medium | 5.3 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-100299 In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the device includes a legacy... |
medium | 6.8 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102830 JupyterLab is an extensible environment for interactive and reproducible computi... |
medium | 6.8 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-19444 A path traversal vulnerability was discovered in the Kubernetes kubectl client's... |
medium | 6.5 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-76720 A vulnerability in HPE OneView can be remotely exploited to cause a URL redirect... |
medium | 4.3 | — | — | 2026-09-29 | 2026-09-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.