September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-54676 Scoold is a Q&A and a knowledge sharing platform for teams. |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-52852 Traccar is an open source GPS tracking system. |
medium | 6.5 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54565 rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. |
medium | 4.7 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54645 CubeCart is an ecommerce software solution. |
medium | 4.8 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54147 http4k is a functional toolkit for Kotlin HTTP applications. |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-61794 Capsule is a multi-tenancy and policy-based framework for Kubernetes. |
medium | 6.8 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-61795 Capsule is a multi-tenancy and policy-based framework for Kubernetes. |
medium | 6.8 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-63405 AnyCable is a realtime server for reliable two-way communication that supports a... |
medium | 5.9 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-63406 AnyCable is a realtime server for reliable two-way communication that supports a... |
medium | 5.9 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-77386 Kyoo is a self-hosted media server focused on movies, series, and anime. |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-84992 md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-52745 CordysCRM is an open source AI-powered customer relationship management system t... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-61720 FluidSynth is a software synthesizer based on the SoundFont 2 specifications. |
medium | 6.2 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-61723 FluidSynth is a software synthesizer based on the SoundFont 2 specifications. |
medium | 6.8 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-76900 CordysCRM is an open source AI-powered customer relationship management system t... |
medium | 6.8 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-76901 CordysCRM is an open source AI-powered customer relationship management system t... |
medium | 5.8 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-77528 Autobahn Python is a WebSocket and WAMP implementation for Python that supports... |
medium | 5.3 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-61670 microsandbox is an easy, fast, local-first microVM runtime and library. |
medium | 6.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-85271 Open edX Platform enables the authoring and delivery of online learning at any s... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-61630 nginx ignition is a user interface for the nginx web server. |
medium | 4.2 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-59168 Dasel is a command-line tool and library for querying, modifying, and transformi... |
medium | 6.2 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-62866 Dasel is a command-line tool and library for querying, modifying, and transformi... |
medium | 6.2 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-62987 Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. |
medium | 5.8 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-61612 CKAN MCP Server is a tool for querying CKAN open data portals. |
medium | 5.7 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-63329 Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. |
medium | 4.9 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-91164 Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. |
medium | 4.3 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-62247 Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSock... |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-58270 Sync-in Server is an open-source platform for file storage, sharing, collaborati... |
medium | 6.5 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-61743 Chartbrew is an open-source web application that can connect directly to databas... |
medium | 6.3 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-75517 Novu provides an API for sending notifications through multiple channels. |
medium | 6.5 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-93290 Omni C20 uses hard-coded credentials that could allow an attacker to monitor log... |
medium | 5.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-77606 Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-77608 Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-77609 Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-77610 Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-77616 Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users... |
medium | 6.1 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-54495 The OpenFeature Operator allows users to expose feature flags to applications. |
medium | 4.3 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-85272 Open edX Platform enables the authoring and delivery of online learning at any s... |
medium | 4.3 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-76802 Nuclei is a vulnerability scanner built on a simple YAML-based DSL. |
medium | 4.7 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-94588 In Proxmox pmg-api, an argument injection vulnerability exists in the package ch... |
medium | 4.4 | — | — | 2026-09-21 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.