September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,321
Critical
1,226
High
4,361
Medium
4,108
Low
460
Severity not reported
1,166
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-54649 punchin-email is a Cloudflare Email Worker that provides two-way role aliases wh... |
not reported | — | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-55062 uniget is a universal installer and updater for (container) tools. |
not reported | — | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-63199 Perses is an open-source dashboard and visualization project for observability d... |
not reported | — | — | — | 2026-09-18 | 2026-09-30 |
| CVE-2026-77582 Tinyauth is an authentication and authorization server. |
not reported | — | — | — | 2026-09-21 | 2026-09-30 |
| CVE-2026-61541 Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of... |
not reported | — | — | — | 2026-09-21 | 2026-09-30 |
| CVE-2026-93421 Mesop is a Python-based UI framework that allows users to build web applications... |
not reported | — | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-59980 hpack is an HTTP/2 Header Encoding for Python. |
not reported | — | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-61604 The ixo Blockchain is a Layer 1 blockchain that runs on both Testnet and Mainnet... |
not reported | — | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-61742 DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB,... |
not reported | — | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-27867 An attacker with access via network to the Regesta Smart HD-PLC of the provider... |
not reported | — | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-100248 The Rattadan Cosmowarp smart contract before 56c6147 can have a comparison to an... |
not reported | — | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-81871 OpenTelemetry-Go is the Go implementation of OpenTelemetry. |
not reported | — | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-54355 MapServer is a system for developing web-based GIS applications. |
not reported | — | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-4034 Injection Vulnerability in Tibco Administrator version 5.13.0 & prior allows an... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-13087 Rejected reason: This CVE was reserved in error and duplicates CVE-2026-89530. |
not reported | — | — | — | 2026-09-22 | 2026-09-30 |
| CVE-2026-103239 MISP contains a privilege escalation vulnerability in the tag collection creatio... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102511 Improper Verification of Source of a Communication Channel in the ADS discovery... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-92284 Caddy is an extensible server platform that uses TLS by default. |
not reported | — | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-92700 Caddy is an extensible server platform that uses TLS by default. |
not reported | — | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-91860 A prototype pollution vulnerability exists in the deep merge helpers of Vaadin C... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-93547 A missing authorization check in the Vaadin Spreadsheet component allows an auth... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-95509 Strings optimized for Latin-1 displaying Latin-1 characters cause incorrect Stri... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-103441 Deserialization of untrusted data vulnerability in The Wikimedia Foundation Medi... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103442 External control of system or configuration setting vulnerability in The Wikimed... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97685 An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surve... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-96440 Improper Limitation of a Pathname to a Restricted
Directory（Path Traversal） in... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-97259 Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-92103 Allocation of Resources Without Limits or Throttling vulnerability in elixir-min... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-103389 MISP contains a stored cross-site scripting (XSS) vulnerability in the galaxy ic... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103388 MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whene... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102371 In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as roo... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102252 A path traversal vulnerability (CWE-22) in the embedded VMDK filesystem extracto... |
not reported | — | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102508 Improper Verification of Cryptographic Signature and Improper Certificate Valida... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102509 Memory Allocation with Excessive Size Value, Allocation of Resources Without Lim... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102510 Integer Overflow, Improper Validation of Array Index, Uncontrolled Recursion and... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103012 Claude Code selected an API key stored by Claude Code, for example from an earli... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103235 MISP contains a mass assignment vulnerability in the event delegation feature. |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-96342 Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94194 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-7170 Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoin... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.