September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,313
Critical
1,226
High
4,359
Medium
4,108
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100542 OpenClaw (npm package 'openclaw') versions >= 2026.5.28 and < 2026.8.1 mishandle... |
low | 3.1 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100534 OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability... |
low | 3.1 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100311 A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to... |
low | 3.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-86839 The Online Scheduling and Appointment Booking System WordPress plugin before 28.... |
low | 3.8 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-101333 A flaw was found in the Micrometer user-event metrics listener of Keycloak, a so... |
low | 3.7 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-92628 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6... |
low | 3.1 | — | Gitlab / gitlab | 2026-09-24 | 2026-09-28 |
| CVE-2026-101051 Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote... |
low | 3.1 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-96525 The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an o... |
low | 2.7 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-96526 The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an o... |
low | 2.7 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100880 A weakness has been identified in zhistaredu StarTraining up to 3.8.1. |
low | 3.5 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100881 A security vulnerability has been detected in zhistaredu StarTraining up to 3.8.... |
low | 2.6 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100904 A security vulnerability has been detected in amirsanni mini-inventory-and-sales... |
low | 3.5 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-81884 radare2 is a UNIX-like reverse engineering framework and command-line toolset. |
low | 3.3 | — | Radare / radare2 | 2026-09-22 | 2026-09-28 |
| CVE-2026-81883 radare2 is a UNIX-like reverse engineering framework and command-line toolset. |
low | 3.3 | — | Radare / radare2 | 2026-09-22 | 2026-09-28 |
| CVE-2026-71178 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
low | 3.7 | — | Dell / policy manager for secure connect gateway | 2026-09-23 | 2026-09-26 |
| CVE-2026-62364 wlc is a Weblate command-line client using Weblate's REST API. |
low | 2.3 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-95657 A vulnerability was determined in dgtlmoon Changedetection.io up to 0.55.8. |
low | 3.5 | — | — | 2026-09-22 | 2026-09-26 |
| CVE-2026-93394 A flaw in libmongoc's SCRAM authentication implementation caused the client to c... |
low | 3.7 | — | Mongodb / c driver | 2026-09-17 | 2026-09-25 |
| CVE-2026-71463 Notification template Jinja AST whitelist only inspects
static Getattr nodes. |
low | 2.7 | — | — | 2026-09-23 | 2026-09-25 |
| CVE-2026-96546 A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS ima... |
low | 2.5 | — | — | 2026-09-23 | 2026-09-25 |
| CVE-2026-97868 A security vulnerability has been detected in sheshbabu zen up to 1.5.0. |
low | 3.5 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-97228 Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query... |
low | 2.7 | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-94426 A vulnerability was determined in xuxueli xxl-job up to 3.5.0. |
low | 3.5 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-63416 draw.io is a configurable diagramming and whiteboarding application. |
low | 3.7 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-86071 Junrar is an open source Java RAR archive library. |
low | 3.7 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-91165 Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. |
low | 2.4 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-69200 node-opcua is an OPC UA implementation for TypeScript and Node.js. |
low | 3.7 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-55060 GoCD is a continuous deliver server. |
low | 3.7 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-85716 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
low | 3.7 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-92706 Dark Reader is an accessibility browser extension that makes web pages colors da... |
low | 3.4 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-96675 alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the mult... |
low | 3.3 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-73064 In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can caus... |
low | 2.9 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-77797 Velociraptor's prefetch library contains an out of bound vulnerability which may... |
low | 3.6 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-90771 joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerabil... |
low | 3.7 | — | — | 2026-09-13 | 2026-09-24 |
| CVE-2026-55290 In setTo of ResourceTypes.cpp, there is a possible out-of-bounds heap read due t... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-81161 Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation... |
low | 3.3 | — | Content Moderation Notifications Project / content moderation notifications | 2026-09-02 | 2026-09-24 |
| CVE-2026-96810 A vulnerability was identified in huanzi-qch base-admin up to 52816b760cd5324498... |
low | 3.5 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96552 A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8f... |
low | 3.1 | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-49895 In get_eht_operation_channel_width of ieee802_11_common.c, there is a possible o... |
low | 3.5 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-45519 In screenArgsForPermissionCheckIfAny of multiple locations there is a possible r... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.