September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,321
Critical
1,226
High
4,361
Medium
4,108
Low
460
Severity not reported
1,166
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-85520 Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerable to unau... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-68911 Nicotine+ is a graphical client for the Soulseek peer-to-peer network. |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-93853 Unverified ownership in Barman snapshot backup deletion allows a principal who c... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-74864 sogo_yhn configures SOGo with a parameter that forces the request with HTTP head... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-74865 sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94545 Satori is a library to convert HTML and CSS to SVG. |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-80490 Algorithm::AhoCorasick::XS versions through 0.04 for Perl read the haystack stri... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-101898 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101900 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101902 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101903 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101904 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101906 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101907 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101908 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-15390 Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-19547 Ghostscript for Windows is vulnerable to local privilege escalation through Post... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102598 Werkzeug is a comprehensive WSGI web application library. |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-97711 Serialize JavaScript serializes JavaScript values to a superset of JSON that inc... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102930 virtualenv is a tool for creating isolated virtual python environments. |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-10726 Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclos... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-10739 Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102983 Astro is a web framework for content-driven websites. |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103470 In Internet2 Grouper before 7.5.1 (in some configurations), a user who is allowe... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103237 MISP contains an improper input validation vulnerability in its ORM save path. |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-88061 career-ops is an open-source AI-assisted job search and application management t... |
not reported | — | — | — | 2026-09-10 | 2026-09-30 |
| CVE-2026-50025 Mousehole is a background service to update a seedbox IP for MAM and web app to... |
not reported | — | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-55795 Craft Commerce is an ecommerce platform for Craft CMS. |
not reported | — | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54452 safeurl is a server-side request forgery protection library. |
not reported | — | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-52821 Kimai is an open-source time tracking application. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-52824 Kimai is an open-source time tracking application. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-52827 Kimai is an open-source time tracking application. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-47780 free5GC is an open-source implementation of the 5G core network. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-49254 Dragonfly is an open source P2P-based file distribution and image acceleration s... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54254 Cyberdrop-DL is a bulk asynchronous downloader for multiple file hosts. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54637 Dragonfly is an open source P2P-based file distribution and image acceleration s... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55617 Hydro is a next-generation high-performance online judge platform. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54450 ToolHive is a utility designed to simplify the deployment and management of Mode... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55630 Kiwi TCMS is an open source test management system. |
none | 0.0 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55828 qbee transport is a remote access transport protocol implementation. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.