September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-50291 OpenImageIO is a toolset for reading, writing, and manipulating image files of a... |
medium | 5.5 | — | Openimageio / openimageio | 2026-09-17 | 2026-09-29 |
| CVE-2026-101202 A flaw has been found in FastStone Image Viewer up to 8.3. |
medium | 6.3 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-101205 A vulnerability was determined in FastStone Image Viewer up to 8.3. |
medium | 6.3 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-101277 A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.1... |
medium | 6.5 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-101279 A security vulnerability has been detected in Trusted Domain Project OpenDMARC u... |
medium | 6.5 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-101858 A flaw has been found in RaspAP raspap-webgui up to 3.5.5. |
medium | 4.7 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102244 A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. |
medium | 4.3 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102247 A vulnerability was detected in FastAdmin 1.6.1.20250430/1.6.5.20260602. |
medium | 6.8 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102263 A vulnerability has been found in mwasikz robo-cafe-rms up to 228c44a02823f04e85... |
medium | 4.7 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102292 A flaw has been found in coolbeans1212 MateisHomePage-Website up to ea2a4226deec... |
medium | 4.3 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-59156 OpenImageIO is a toolset for reading, writing, and manipulating image files of a... |
medium | 6.5 | — | Openimageio / openimageio | 2026-09-18 | 2026-09-29 |
| CVE-2026-59181 OpenImageIO is a toolset for reading, writing, and manipulating image files of a... |
medium | 6.1 | — | Openimageio / openimageio | 2026-09-18 | 2026-09-29 |
| CVE-2026-59956 OpenImageIO is a toolset for reading, writing, and manipulating image files of a... |
medium | 6.1 | — | Openimageio / openimageio | 2026-09-18 | 2026-09-29 |
| CVE-2026-100286 Missing authorization in the data source settings API in Devolutions Server 2026... |
medium | 6.5 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-100287 Missing authorization in the attachment history API in Devolutions Server 2026.3... |
medium | 5.4 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-100289 Missing authorization in the gateway network scan token API in Devolutions Serve... |
medium | 5.0 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-93330 Improper rule enforcement in the PAM Active Directory provider in Devolutions Se... |
medium | 4.3 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-63420 OpenImageIO is a toolset for reading, writing, and manipulating image files of a... |
medium | 5.5 | — | Openimageio / openimageio | 2026-09-18 | 2026-09-29 |
| CVE-2026-63635 OpenImageIO is a toolset for reading, writing, and manipulating image files of a... |
medium | 5.5 | — | Openimageio / openimageio | 2026-09-18 | 2026-09-29 |
| CVE-2026-65969 OpenImageIO is a toolset for reading, writing, and manipulating image files of a... |
medium | 5.5 | — | Openimageio / openimageio | 2026-09-18 | 2026-09-29 |
| CVE-2026-65970 OpenImageIO is a toolset for reading, writing, and manipulating image files of a... |
medium | 5.3 | — | Openimageio / openimageio | 2026-09-18 | 2026-09-29 |
| CVE-2026-65127 NVIDIA Infrastructure Controller for Linux contains a vulnerability where an att... |
medium | 4.9 | — | Nvidia / infra controller | 2026-09-22 | 2026-09-29 |
| CVE-2026-88060 Angular is a development platform for building mobile and desktop web applicatio... |
medium | 6.1 | — | Angular / angular | 2026-09-10 | 2026-09-29 |
| CVE-2026-94396 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of... |
medium | 6.5 | — | Elastic / elasticsearch | 2026-09-26 | 2026-09-29 |
| CVE-2026-82294 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial... |
medium | 6.5 | — | Elastic / elasticsearch | 2026-09-26 | 2026-09-29 |
| CVE-2026-65112 NVIDIA Infrastructure Controller for Linux contains a vulnerability where an att... |
medium | 6.5 | — | Nvidia / infra controller | 2026-09-22 | 2026-09-29 |
| CVE-2026-96651 Plex Media Server before 1.43.3.10861 builds a file path from the url parameter... |
medium | 6.5 | — | Plex / media server | 2026-09-23 | 2026-09-29 |
| CVE-2026-65115 NVIDIA Infrastructure Controller for Linux contains a vulnerability where an att... |
medium | 6.5 | — | Nvidia / infra controller | 2026-09-22 | 2026-09-29 |
| CVE-2026-100521 Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in... |
medium | 6.1 | — | — | 2026-09-26 | 2026-09-29 |
| CVE-2026-100529 OpenClaw versions before 2026.8.1 contain an authorization scope widening vulner... |
medium | 6.4 | — | — | 2026-09-26 | 2026-09-29 |
| CVE-2026-100533 OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in the... |
medium | 5.3 | — | — | 2026-09-26 | 2026-09-29 |
| CVE-2026-100304 TDuck survey form 6.0 contains an information disclosure vulnerability in FormAu... |
medium | 5.3 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-96606 A security flaw has been discovered in LB-Link BL-CPE600EU 5.8.13. |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-29 |
| CVE-2026-84540 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | Apple / macos | 2026-09-14 | 2026-09-29 |
| CVE-2026-44940 The rancher-extension-stackstate extension in SUSE Observability exposes service... |
medium | 5.7 | — | — | 2026-09-17 | 2026-09-29 |
| CVE-2026-100574 OpenClaw (npm package 'openclaw') before 2026.8.1 contains a server-side request... |
medium | 5.9 | — | — | 2026-09-26 | 2026-09-29 |
| CVE-2026-100545 OpenClaw (npm package `openclaw`) before 2026.8.1 incorrectly enforces sender to... |
medium | 5.3 | — | — | 2026-09-26 | 2026-09-29 |
| CVE-2026-100549 OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in QQBo... |
medium | 5.4 | — | — | 2026-09-26 | 2026-09-29 |
| CVE-2026-100553 OpenClaw versions >= 2026.6.9 and < 2026.8.1 do not declare the native chatId pa... |
medium | 4.3 | — | — | 2026-09-26 | 2026-09-29 |
| CVE-2026-63498 Snipe-IT is an IT asset/license management system. |
medium | 5.4 | — | Snipeitapp / snipe-it | 2026-09-24 | 2026-09-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.