September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,321
Critical
1,226
High
4,361
Medium
4,108
Low
460
Severity not reported
1,166
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-7171 Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoin... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-7172 Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoin... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-81867 A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Goog... |
not reported | — | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-103321 MISP contains a stored cross-site script (XSS) vulnerability in the event graph... |
not reported | — | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-86066 Horilla is an HR and CRM software. |
not reported | — | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-48482 GLPI is a free asset and IT management software package. |
not reported | — | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-53626 GLPI is a free asset and IT management software package. |
not reported | — | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-53628 GLPI is a free asset and IT management software package. |
not reported | — | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-96874 Improper neutralization of input during web page generation ('cross-site scripti... |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-96875 Improper neutralization of input during web page generation ('cross-site scripti... |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-96876 Improper neutralization of input during web page generation ('cross-site scripti... |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-96877 Improper neutralization of input during web page generation ('cross-site scripti... |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-96878 Improper neutralization of input during web page generation ('cross-site scripti... |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-96879 Improper removal of sensitive information before storage or transfer vulnerabili... |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-102711 Two issues in the ThreadX loadable-module loader, reached when a device loads an... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102712 On the first DTLS ClientHello, the parser copies a device-claimed session_id len... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102759 NetX Secure TLS accepts an empty application-data record without verifying its m... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102760 When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on a... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-11796 Asset Suite allows unauthenticated users to access PropertiesReloadServlet, Cach... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-7395 Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-87723 In Google fuse-archive versions prior to 1.24, an attacker who can prepend a dir... |
not reported | — | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-19759 An Incorrect Authorization vulnerability in the task configuration in Google Clo... |
not reported | — | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-81375 A Confused Deputy vulnerability in the EmailTask component in Google Cloud Appli... |
not reported | — | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-102242 Improper link resolution (CWE-59 / CWE-22) in the allowedLocalRoots path validat... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-7192 A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi miniro... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-7193 A vulnerability relating to the use of predefined credentials in the Dbit T-CPE3... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-96428 SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-96429 SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API
endpoint of Flowring... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-96430 Exposed Dangerous Method or Function in the
/WebAgenda/SQLWin.do API endpoint of... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-96431 Unrestricted Upload of File with Dangerous Type in the
/WebAgenda/download/uploa... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-95832 Improper Neutralization of Special Elements in Output Used by a Downstream Compo... |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-80430 Improper Link Resolution Before File Access in the drag source staging path of t... |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-80431 Out-of-bounds Write in the natural width branch of the text sizing protocol in k... |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-80432 Missing Authorization in the drop handling path of the drag and drop protocol in... |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-95834 Use After Free in the drag source path of the drag and drop protocol in kitty fr... |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-95835 Missing Authorization in the askpass escape code handler in kitty from 0.25.0 be... |
not reported | — | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-91154 Missing Authentication for Critical Function (CWE-306) in the product cache reva... |
not reported | — | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-101266 A logic flaw in the checkout flow allows users to bypass validations performed d... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-101267 A missing permission check allowed low-privileged users with access to an event... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-101268 If an attacker is able to convince a victim on a specially crafted link, the vic... |
not reported | — | — | — | 2026-09-29 | 2026-09-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.