September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,327
Critical
1,227
High
4,362
Medium
4,108
Low
460
Severity not reported
1,170
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-97064 X-SpringBoot through 6.0 ships with a hardcoded static master login verification... |
critical | 9.1 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-88864 Capgo (capgo.app) fails to restrict direct write access to the public.sso_provid... |
critical | 9.1 | — | — | 2026-09-10 | 2026-09-30 |
| CVE-2026-101065 Obot is an open-source AI agent/MCP platform. |
critical | 9.8 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100717 froxlor is a server administration panel. |
critical | 9.9 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2023-53899 PodcastGenerator 3.2.9 contains a blind server-side request forgery vulnerabilit... |
critical | 9.8 | — | Podcastgenerator / podcast generator | 2025-12-16 | 2026-09-30 |
| CVE-2026-54072 Authorizer is an open-source, self-hostable authentication and authorization ser... |
critical | 9.3 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-61534 Yayson is a library for serializing and reading JSON API data in JavaScript. |
critical | 9.1 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-50006 Anyquery is an SQL query engine built on top of SQLite. |
critical | 9.1 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54333 UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures includi... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54334 UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures includi... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-55209 resdata is software for reading and writing result files from the Eclipse reserv... |
critical | 9.8 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-55211 Surfio is a library for reading and writing surface files. |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-53710 MCP Context Forge is an AI gateway, registry, and proxy for MCP, A2A, REST, and... |
critical | 10.0 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-45579 DIRAC is an interware, meaning a software framework for distributed computing. |
critical | 9.9 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-61667 DIRAC is an interware, meaning a software framework for distributed computing. |
critical | 9.9 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54337 Fireshare facilitates self-hosted media and link sharing. |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-61559 `@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. |
critical | 9.6 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-61568 `@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. |
critical | 9.6 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-61560 `@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. |
critical | 9.8 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-61594 djust provides Phoenix LiveView-style reactive server-side rendering for Django... |
critical | 9.1 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-47252 Anyquery is an SQL query engine built on top of SQLite. |
critical | 9.0 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-53713 Envoy Gateway is an open source project for managing Envoy Proxy as a standalone... |
critical | 9.1 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-59971 MySQL MCP Server is a Model Context Protocol server that enables secure interact... |
critical | 10.0 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54053 Many Notes is a Markdown note-taking web application designed for simplicity. |
critical | 9.6 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-54618 Obsidian Web MCP is a secure remote MCP server for Obsidian vaults. |
critical | 9.4 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-54460 OpenReception's appointment booking software provides an end-to-end encrypted ap... |
critical | 9.8 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-77240 WACRM is a self-hostable CRM template for WhatsApp. |
critical | 9.9 | — | — | 2026-09-18 | 2026-09-30 |
| CVE-2026-61732 Decepticon is an autonomous hacking agent for red teams. |
critical | 10.0 | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2023-54400 Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.a... |
critical | 9.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-77177 Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for Wha... |
critical | 9.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-79537 metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference... |
critical | 9.1 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-12342 This vulnerability
impacts all versions of IdentityIQ and allows an unauthentica... |
critical | 9.6 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-94952 A stack-based buffer overflow vulnerability exists in the web management interfa... |
critical | 9.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-77185 Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0... |
critical | 9.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102911 A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. |
critical | 9.9 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-63713 The "search" parameter in the view audit logs feature within the utilities secti... |
critical | 9.0 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-68068 The "screenID" parameter in the electronic transaction queue viewer feature with... |
critical | 9.0 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-68954 The "pattern" parameter used in search function in the home page of the TMS appl... |
critical | 9.0 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-70356 The TMS file upload endpoint fails to enforce server-side file type restrictions... |
critical | 9.1 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-71379 The file export endpoint allows any unauthenticated attacker to export arbitrary... |
critical | 10.0 | — | — | 2026-09-29 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.