September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-95396 A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8f... |
medium | 4.3 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-84301 FastGPT is an open-source LLM platform for building AI applications on a knowled... |
medium | 6.3 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-85725 LightRAG provides simple and fast retrieval-augmented generation. |
medium | 5.9 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-85288 Notepad++ is a free and open-source source code editor. |
medium | 6.7 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-81880 radare2 is a UNIX-like reverse engineering framework and command-line toolset. |
medium | 5.5 | — | Radare / radare2 | 2026-09-22 | 2026-09-26 |
| CVE-2026-83601 Netdata is an open source observability tool. |
medium | 6.5 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-76803 Nuclei is a vulnerability scanner built on a simple YAML-based DSL. |
medium | 5.3 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-88264 A flaw was found in crun. |
medium | 5.6 | — | — | 2026-09-10 | 2026-09-25 |
| CVE-2026-88831 BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving... |
medium | 5.3 | — | — | 2026-09-23 | 2026-09-25 |
| CVE-2026-88835 BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb... |
medium | 6.1 | — | — | 2026-09-23 | 2026-09-25 |
| CVE-2026-88837 BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Au... |
medium | 6.5 | — | — | 2026-09-23 | 2026-09-25 |
| CVE-2026-88839 BusyBox passwd/group tokenize() references a stale endpoint pointer after trimmi... |
medium | 6.7 | — | — | 2026-09-23 | 2026-09-25 |
| CVE-2026-78516 Insertion of sensitive information into externally-accessible file or directory... |
medium | 4.3 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-25 |
| CVE-2026-100373 OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability... |
medium | 4.1 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-77490 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Microsoft / edge chromium | 2026-09-11 | 2026-09-25 |
| CVE-2026-68526 Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar ev... |
medium | 4.3 | — | Concretecms / concrete cms | 2026-09-11 | 2026-09-25 |
| CVE-2026-93395 A missing lower-bound validation in the bson_new_from_buffer() function of libbs... |
medium | 5.3 | — | Mongodb / c driver | 2026-09-17 | 2026-09-25 |
| CVE-2026-52743 GoCD is a continuous deliver server. |
medium | 4.3 | — | — | 2026-09-21 | 2026-09-25 |
| CVE-2026-83946 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Microsoft / azure portal | 2026-09-18 | 2026-09-25 |
| CVE-2026-82355 When a request to the Airflow core API carries both a session cookie and an expl... |
medium | 4.2 | — | Apache / airflow | 2026-09-21 | 2026-09-25 |
| CVE-2026-83488 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: hel... |
medium | 5.4 | — | Oracle / helidon | 2026-09-15 | 2026-09-25 |
| CVE-2026-83480 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Web... |
medium | 5.3 | — | Oracle / helidon | 2026-09-15 | 2026-09-25 |
| CVE-2026-83460 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: LRA... |
medium | 6.5 | — | Oracle / helidon | 2026-09-15 | 2026-09-25 |
| CVE-2026-75656 Bridge is affected by an out-of-bounds read vulnerability that could lead to dis... |
medium | 5.5 | — | Adobe / bridge | 2026-09-22 | 2026-09-25 |
| CVE-2026-93339 Metaphor Creations Ditty (ditty-news-ticker) before 3.1.70 contains a stored cro... |
medium | 5.4 | — | — | 2026-09-21 | 2026-09-25 |
| CVE-2026-88367 NanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvg... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-71459 JobJobEventsChildrenSummary view has no model/parent_model. |
medium | 5.0 | — | — | 2026-09-23 | 2026-09-25 |
| CVE-2026-48543 Krayin CRM through 2.2.6 contains a stored client-side template injection vulner... |
medium | 5.4 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-77252 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
medium | 6.5 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-25 |
| CVE-2026-97636 Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-sc... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-88761 The Botslab G980H dash camera firmware generates the default WiFi password using... |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-88956 The Botslab G980H dash camera firmware contains an authentication vulnerability... |
medium | 6.8 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-88359 libfyaml 0.9.6 contains a stack exhaustion vulnerability in fy_atom_iter_format(... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-88386 libsndfile 1.2.2 contains a misaligned memory access issue in psf_binheader_read... |
medium | 5.5 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-87118 The Botslab G980H dash camera firmware contains an out of bounds write vulnerabi... |
medium | 5.7 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-82585 The Botslab G980H dash camera firmware transmits sensitive information over unen... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-82708 The Botslab G980H dash camera firmware contains a path traversal vulnerability i... |
medium | 6.5 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-82716 The Botslab G980H dash camera firmware includes sensitive configuration informat... |
medium | 4.6 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-84403 The Botslab G980H dash camera firmware does not require authenticated pairing or... |
medium | 6.2 | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-75558 The Botslab G980H dash camera firmware uses a hard-coded cryptographic key and i... |
medium | 5.3 | — | — | 2026-09-24 | 2026-09-25 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.