September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-101078 A vulnerability has been found in deepseek-ai deepseek-harness up to 0.1.7-rc.2. |
medium | 6.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101080 A vulnerability was identified in Tencent AI-Infra-Guard up to 4.5.2/4.6.2. |
medium | 4.8 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101083 A security vulnerability has been detected in PMWeb v7.x/v8.x/v2025.x. |
medium | 5.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101098 A security vulnerability has been detected in ag-ui-protocol ag-ui up to 2026-09... |
medium | 4.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101100 A flaw has been found in ag-ui-protocol ag-ui up to 2026-09-07. |
medium | 5.4 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101101 A vulnerability has been found in ag-ui-protocol ag-ui up to 2026-09-07. |
medium | 4.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101105 A vulnerability was determined in code-projects Matrimonial System 1.0. |
medium | 6.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100853 In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to veri... |
medium | 5.9 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-101049 Heym before 0.0.53 fails to verify Slack request signatures when trigger nodes l... |
medium | 6.5 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-101063 Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endp... |
medium | 5.3 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-101086 Nezha Dashboard versions before 2.3.5 fail to restrict service monitor task type... |
medium | 6.5 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100628 capgo.app before 12.128.12 fails to enforce an organization's API key expiration... |
medium | 4.3 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100860 heym before 0.0.105 does not act on the result of the credential authorization l... |
medium | 5.5 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100861 heym before 0.0.105 fails to apply egress guards to integration services that us... |
medium | 5.0 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100869 Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions... |
medium | 5.9 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-101050 Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on... |
medium | 6.5 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-101085 Nezha before 2.3.8 fails to validate alert rule type and duration bounds, allowi... |
medium | 6.5 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-93364 Bludit CMS through 3.22.0 contains a mass assignment vulnerability that allows a... |
medium | 4.3 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-93365 Bludit CMS through 3.22.0 contains a missing authorization vulnerability that al... |
medium | 6.5 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-100305 TDuck survey form through 6.0 fails to enforce form fill-in restrictions on the... |
medium | 4.3 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-100626 capgo through 12.128.2 contains an insecure direct object reference vulnerabilit... |
medium | 4.3 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-6544 IBM Concert 1.0.0 through 3.0.0 allows recursive copying of directories without... |
medium | 6.2 | — | Ibm / concert | 2026-09-24 | 2026-09-28 |
| CVE-2026-6925 IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to traverse direct... |
medium | 5.3 | — | Ibm / concert | 2026-09-23 | 2026-09-28 |
| CVE-2026-70582 Concurrent execution using shared resource with improper synchronization ('race... |
medium | 6.4 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-77492 Out-of-bounds read in Storage Port Driver allows an authorized attacker to discl... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-76804 Nuclei is a vulnerability scanner built on a simple YAML-based DSL. |
medium | 5.5 | — | — | 2026-09-22 | 2026-09-28 |
| CVE-2026-83602 Netdata is an open source observability tool. |
medium | 6.5 | — | — | 2026-09-22 | 2026-09-28 |
| CVE-2026-100590 OpenClaw before 2026.7.1 contains an authorization bypass vulnerability in the /... |
medium | 4.3 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100594 OpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability... |
medium | 6.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100313 A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to... |
medium | 4.3 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-12910 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6... |
medium | 5.4 | — | Gitlab / gitlab | 2026-09-15 | 2026-09-28 |
| CVE-2026-82837 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.... |
medium | 4.3 | — | Gitlab / gitlab | 2026-09-15 | 2026-09-28 |
| CVE-2026-100902 A vulnerability was determined in Barco ClickShare CX-20 Gen2 up to 02.26.00.000... |
medium | 6.5 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100659 Netty's HTTP/3 codec (io.netty:netty-codec-http3) in versions 4.2.0.Final throug... |
medium | 6.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100667 grav-plugin-login (the Grav CMS Login plugin) versions >= 3.8.7 and < 3.9.7 allo... |
medium | 5.3 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-86341 GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 bef... |
medium | 4.4 | — | Gitlab / gitlab | 2026-09-16 | 2026-09-28 |
| CVE-2026-92529 GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 bef... |
medium | 4.3 | — | Gitlab / gitlab | 2026-09-24 | 2026-09-28 |
| CVE-2026-92530 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1... |
medium | 4.3 | — | Gitlab / gitlab | 2026-09-24 | 2026-09-28 |
| CVE-2026-6327 IBM Concert 1.0.0 through 3.0.0 could allow an unauthorized user to inject data... |
medium | 4.3 | — | Ibm / concert | 2026-09-23 | 2026-09-28 |
| CVE-2026-6718 IBM Concert 1.0.0 through 3.0.0 is vulnerable to improper access control which a... |
medium | 6.2 | — | Ibm / concert | 2026-09-23 | 2026-09-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.