September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-62762 Null pointer dereference in Active Directory Domain Services allows an authorize... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-65812 Insertion of sensitive information into sent data in Microsoft Teams for Android... |
medium | 6.8 | — | Microsoft / teams | 2026-09-08 | 2026-09-29 |
| CVE-2026-68852 Use of uninitialized resource in Microsoft Account allows an authorized attacker... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-78214 An authentication bypass vulnerability exists in the protection of Actuator endp... |
medium | 5.3 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-81569 An improper authorization vulnerability exists in the handling of sub-workflow t... |
medium | 4.3 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-88026 Improper neutralization of regular-expression metacharacters in the LINQ query t... |
medium | 6.5 | — | Mongodb / c\# driver | 2026-09-10 | 2026-09-29 |
| CVE-2026-58504 draw.io is a configurable diagramming and whiteboarding application. |
medium | 6.1 | — | — | 2026-09-21 | 2026-09-29 |
| CVE-2026-61744 InvenTree is an Open Source Inventory Management System. |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-29 |
| CVE-2026-71897 An improper authorization check in Apache DolphinScheduler allows an authenticat... |
medium | 4.3 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-71898 An incorrect authorization check in Apache DolphinScheduler allows an authentica... |
medium | 4.3 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-88028 Improper neutralization of special elements in data query logic in the polymorph... |
medium | 6.5 | — | Mongodb / laravel mongodb | 2026-09-10 | 2026-09-29 |
| CVE-2026-68881 Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to di... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-68895 Numeric truncation error in Internet Storage Name Service allows an authorized a... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-69375 Authorization bypass through user-controlled key in Microsoft Exchange Server al... |
medium | 6.5 | — | Microsoft / exchange server | 2026-09-08 | 2026-09-29 |
| CVE-2026-82385 Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.... |
medium | 6.5 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-82387 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 5.4 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-63342 Hatchet is a platform for orchestrating background tasks, AI agents, and durable... |
medium | 6.3 | — | — | 2026-09-21 | 2026-09-29 |
| CVE-2026-62370 KubeEdge is an open source system for extending native containerized application... |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-29 |
| CVE-2026-48974 HomeBox is a home inventory and organization system. |
medium | 5.4 | — | — | 2026-09-21 | 2026-09-29 |
| CVE-2026-69382 Use of a broken or risky cryptographic algorithm in Microsoft Exchange Server al... |
medium | 5.9 | — | Microsoft / exchange server | 2026-09-08 | 2026-09-29 |
| CVE-2026-69395 Use of externally-controlled format string in Active Directory Certificate Servi... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-17504 IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31,... |
medium | 4.4 | — | Ibm / power system s1122 \(9824-22a\) firmware | 2026-09-24 | 2026-09-29 |
| CVE-2026-77250 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
medium | 6.1 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-69559 Origin validation error in Microsoft Teams for Android allows an authorized atta... |
medium | 6.3 | — | Microsoft / teams | 2026-09-08 | 2026-09-29 |
| CVE-2026-77251 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
medium | 6.5 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-46650 Joplin is an open source note-taking and to-do application that organises notes... |
medium | 4.4 | — | — | 2026-09-21 | 2026-09-29 |
| CVE-2026-101093 Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in adm... |
medium | 5.4 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-77825 IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversa... |
medium | 4.9 | — | Ibm / contextforge | 2026-09-24 | 2026-09-29 |
| CVE-2026-13018 Insufficient validation of untrusted input in Codecs in Google Chrome prior to 1... |
medium | 4.3 | — | Google / chrome | 2026-09-28 | 2026-09-29 |
| CVE-2026-11871 The Team Members WordPress plugin before 9.3 does not perform any authorization... |
medium | 5.3 | — | — | 2026-09-26 | 2026-09-29 |
| CVE-2026-77269 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
medium | 6.5 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-57222 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
medium | 5.3 | — | Oisf / suricata | 2026-09-18 | 2026-09-29 |
| CVE-2026-94625 vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConn... |
medium | 5.3 | — | Vllm / vllm | 2026-09-21 | 2026-09-29 |
| CVE-2026-68843 Use after free in Microsoft Office Word allows an authorized attacker to disclos... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-102261 A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. |
medium | 5.4 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-97647 A security vulnerability has been detected in ningzichun student-management-syst... |
medium | 5.3 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-97322 A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-97365 A vulnerability was determined in chonkie-inc littrs 0.6.1/0.6.2. |
medium | 6.3 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-77320 TREK is a collaborative travel planner. |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-52850 Docmost is open-source collaborative wiki and documentation software. |
medium | 4.3 | — | — | 2026-09-24 | 2026-09-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.