September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,321
Critical
1,226
High
4,361
Medium
4,108
Low
460
Severity not reported
1,166
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-103437 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vu... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103438 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vu... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103439 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vu... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103440 Exposure of sensitive information through data queries vulnerability in The Wiki... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102990 basic-ftp is an FTP client for Node.js. |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102992 piscina is a node.js worker pool implementation. |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102709 Improper validation of non-secure (NS) pointers in multiple TrustZone-M non-secu... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102710 Attacker model / Preconditions: a loaded `TXM_MODULE_USER_MODE | TXM_MODULE_MEMO... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102761 NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET`... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102762 The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-55177 CloudTAK is a browser-based Common Operating Picture and situational awareness t... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-55094 Taskcluster is the task execution framework that supports Mozilla's continuous i... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103087 Uncontrolled recursion in the Gosub browser engine (gosub-engine) through 0.1.0... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102938 virtualenv is a tool for creating isolated virtual python environments. |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102984 Astro is a web framework for content-driven websites. |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102829 simple-git, an interface for running git commands in any node.js application, en... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-47680 The source-controller is a Kubernetes operator, specialised in artifacts acquisi... |
not reported | — | — | — | 2026-09-08 | 2026-09-30 |
| CVE-2026-88062 OmniRoute is an open-source AI gateway providing a single endpoint for multiple... |
not reported | — | — | — | 2026-09-10 | 2026-09-30 |
| CVE-2026-49836 psd-tools is a Python package for working with Adobe Photoshop PSD files. |
not reported | — | — | — | 2026-09-10 | 2026-09-30 |
| CVE-2026-54047 Laci Synchroni is a decentralized mod and appearance sync server and plugin for... |
not reported | — | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-48490 ArduinoCore-avr contains the source code and configuration files of the Arduino... |
not reported | — | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-54165 Dobase is an open-source, self-hosted workspace with installable tools. |
not reported | — | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-45056 matrix-sdk-crypto is a no-network-IO implementation of a state machine that hand... |
not reported | — | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-55102 hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. |
not reported | — | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-55451 gettext-converter provides gettext resource conversion utilities for JavaScript. |
not reported | — | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-34151 XWiki Platform is a generic wiki platform. |
not reported | — | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-49250 Conform, a type-safe form validation library, allows the parsing of nested objec... |
not reported | — | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54150 next-video is a library for adding video to Next.js applications. |
not reported | — | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-57577 DotVVM is an open source MVVM framework for web applications. |
not reported | — | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-57578 DotVVM is an open source MVVM framework for web applications. |
not reported | — | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-52744 GoCD is a continuous deliver server. |
not reported | — | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-56744 `@bsv/wallet-toolbox` provides BRC-100 wallet signing and storage components, wh... |
not reported | — | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-96538 WarehousePG (WHPG) 7.x before 7.6.0-WHPG is affected by a missing authorization... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-48100 Payy is an Ethereum L2 zk-rollup for privacy preserving and regulatory compliant... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101910 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101912 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101913 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-100371 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-100392 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-41875 Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.