September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,313
Critical
1,226
High
4,359
Medium
4,108
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-69662 The application uses unsafe functions that allow execution of inline scripts and... |
low | 3.7 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-71189 An attacker can construct a request that, if issued by another application user,... |
low | 3.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-95312 Information leak in Passwords in Google Chrome prior to 154.0.8037.57 allowed a... |
low | 3.1 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95316 Unchecked return value in Performance in Google Chrome prior to 154.0.8037.57 al... |
low | 2.9 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95317 Incorrect authorization in MediaCapture in Google Chrome prior to 154.0.8037.57... |
low | 3.1 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95324 Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.57 allowed a... |
low | 3.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-82127 The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not... |
low | 3.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-88791 The Safe Redirect Manager WordPress plugin before 2.3.0 does not properly valida... |
low | 3.4 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94297 The Media Library Organizer WordPress plugin before 2.1.4 does not verify that t... |
low | 2.7 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-100867 spaceship-prompt through 4.22.5 fails to sanitize control characters from projec... |
low | 3.3 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-19492 IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31,... |
low | 3.2 | — | Ibm / power system s1122 \(9824-22a\) firmware | 2026-09-24 | 2026-09-30 |
| CVE-2026-95302 Incorrect authorization in WebAPKs in Google Chrome on on Android prior to 154.0... |
low | 2.9 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102315 Uninitialized resource in Media in Google Chrome on on Windows prior to 154.0.80... |
low | 3.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102319 Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.92 allowed a... |
low | 3.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-27085 Shop manager Content Injection in Astra WordPress Theme <= 4.13.12 versions. |
low | 2.7 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-95359 Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037... |
low | 3.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-76738 A buffer overflow vulnerability exists in the API endpoint of HPE Networking Ins... |
low | 2.7 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102311 Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037... |
low | 3.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-97896 A vulnerability was identified in krayin laravel-crm up to 2.2.5. |
low | 3.5 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-100573 OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability... |
low | 3.3 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100417 RustDesk before 1.5.0 on Windows fails to enforce the one-way file transfer opti... |
low | 3.1 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-75553 Smartphone application Tohoku Electric Power "Yorisou e Net" uses a hard-coded c... |
low | 2.4 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-97399 The strncasecmp function in the GNU C Library 2.24 and later optimized for the P... |
low | 3.7 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-96282 A malicious Flatpak extension can probe the host filesystem to determine what fi... |
low | 3.1 | — | — | 2026-09-27 | 2026-09-29 |
| CVE-2026-96283 By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pul... |
low | 3.3 | — | — | 2026-09-27 | 2026-09-29 |
| CVE-2026-96284 A malicious user can get read-access to files in the flatpak-system-helper conte... |
low | 2.5 | — | — | 2026-09-27 | 2026-09-29 |
| CVE-2026-97025 Flatpak writes the OCI repository authentication token with world-readable permi... |
low | 3.2 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-97027 Flatpak passes through arbitrary vendor-extension keys unmodified when exporting... |
low | 3.6 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-97721 A weakness has been identified in Sanluan PublicCMS up to 6.202506.e. |
low | 2.7 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-102822 Russh is a Rust SSH client and server library. |
low | 3.7 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-101265 A vulnerability was identified in Intelbras TIP 125i 4.3.35/4.3.41. |
low | 3.1 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102290 A vulnerability was determined in CodeCanyon Rocket LMS up to 2.2. |
low | 3.5 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-97897 A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. |
low | 3.5 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-100537 OpenClaw (npm package 'openclaw') before 2026.8.1 fails to apply the originating... |
low | 3.1 | — | — | 2026-09-26 | 2026-09-29 |
| CVE-2026-101139 A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. |
low | 2.7 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-18104 IBM Db2 Mirror for i 7.6, 7.5, and 7.4 could allow a local attacker to obtain se... |
low | 3.3 | — | Ibm / db2 mirror for i | 2026-09-24 | 2026-09-29 |
| CVE-2026-96550 A vulnerability was found in sfturing hosp_order up to 627f426331da8086ce8fff201... |
low | 3.7 | — | — | 2026-09-23 | 2026-09-29 |
| CVE-2026-49449 Joplin is an open source note-taking and to-do application that organises notes... |
low | 2.5 | — | — | 2026-09-21 | 2026-09-28 |
| CVE-2026-101131 A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.5-rc.3. |
low | 3.3 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-101089 Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /... |
low | 3.1 | — | — | 2026-09-27 | 2026-09-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.