September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,321
Critical
1,226
High
4,361
Medium
4,108
Low
460
Severity not reported
1,166
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-55864 GeoNetwork is a catalog application to manage spatially referenced resources. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55887 MCP Gateway allows easy and secure running and deployment of MCP servers. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-46488 motionEye (mEye) is an online interface for a piece of software called "motion,"... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-58201 Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54251 netty-incubator-codec-ohttp implements Oblivious HTTP (OHTTP) gateway and client... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-57441 MCPVault is a lightweight Model Context Protocol server for safe access to files... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-57442 MCPVault is a lightweight Model Context Protocol server for safe access to files... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-58502 githubtoplanguages generates a user's top GitHub languages as an SVG. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-32599 Netmaker makes networks with WireGuard. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-61598 djust provides Phoenix LiveView-style reactive server-side rendering for Django... |
not reported | — | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-82410 Pocketbase is an open source web backend written in go. |
not reported | — | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-77360 oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere t... |
not reported | — | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-81870 OpenTelemetry-Go is the Go implementation of OpenTelemetry. |
not reported | — | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-62997 Kedro-Datasets provides data connectors for Kedro. |
not reported | — | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-61597 djust provides Phoenix LiveView-style reactive server-side rendering for Django... |
not reported | — | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-61599 djust provides Phoenix LiveView-style reactive server-side rendering for Django... |
not reported | — | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-61793 Nuxt OG Image generates OG Images with Vue templates in Nuxt. |
not reported | — | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-69197 Umbraco is an ASP.NET CMS. |
not reported | — | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-49292 Kiwi TCMS is an open source test management system. |
none | 0.0 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-54524 Frappe HR is an open-source human resources management solution (HRMS). |
not reported | — | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-47773 ArduinoBLE enables Bluetooth Low Energy connectivity on certain Arduino models. |
not reported | — | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-54559 PocketSphinx is a small speech recognizer. |
not reported | — | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-61549 Woodpecker is a CI/CD engine. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-61544 libp2p-rust is the official Rust language implementation of the libp2p networkin... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-71538 @cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm p... |
not reported | — | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-45052 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-45794 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-50166 Kuma is a modern Envoy-based service mesh that can run on every cloud across bot... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-52724 Kuma is a modern Envoy-based service mesh that can run on every cloud across bot... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-53966 XWiki Platform is a generic wiki platform. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55701 The OpenTelemetry Collector Contrib repository contains components for the OpenT... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-44778 Inspektor Gadget is a set of tools and framework for data collection and system... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-53658 Fabric CA is a Certificate Authority for Hyperledger Fabric. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-44300 OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-53941 Inspektor Gadget is a set of tools and framework for data collection and system... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-76821 OpenCTI is an open source platform for managing cyber threat intelligence knowle... |
not reported | — | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-59823 LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) fo... |
not reported | — | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-81869 OpenTelemetry-Go is the Go implementation of OpenTelemetry. |
not reported | — | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-81872 OpenTelemetry-Go is the Go implementation of OpenTelemetry. |
not reported | — | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-79752 CakePHP is a rapid development framework for PHP. |
not reported | — | — | — | 2026-09-17 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.