September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,321
Critical
1,226
High
4,361
Medium
4,108
Low
460
Severity not reported
1,166
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-52748 The Kaon AR2140X router contains a vulnerability where the backup functionality... |
not reported | — | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-52749 The Kaon AR2140X router improperly issues session cookies in responses to unauth... |
not reported | — | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82929 mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every d... |
not reported | — | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82930 mH-DEVELOPER smart home module does not verify tokens in its authorization middl... |
not reported | — | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82932 mH-DEVELOPER smart home module does not load any firewall rules at startup. |
not reported | — | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82933 mH-DEVELOPER smart home module sends its web interface and API traffic over unen... |
not reported | — | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82935 mH-DEVELOPER smart home module ships with an end-of-life, unsupported Debian 8 a... |
not reported | — | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-82936 mH-DEVELOPER smart home module is vulnerable to Denial of Service due to uncontr... |
not reported | — | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-26054 SumatraPDF is a multi-format reader for Windows. |
not reported | — | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-53493 containerd is an open-source container runtime. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-88003 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-56723 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-56724 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-56729 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-56726 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-56727 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-56728 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-56731 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-56732 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-56733 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-56735 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-61525 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-65828 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-84462 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-61855 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-63204 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-63206 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-63208 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-84458 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-84461 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-84464 Zammad is a web based open source helpdesk/customer support system. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-57449 Actual is a local-first personal finance tool. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-49470 GLPI is a free asset and IT management software package. |
not reported | — | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2024-27123 A cross-site scripting (XSS) vulnerability has been reported to affect QcalAgent... |
not reported | — | — | — | 2026-09-18 | 2026-09-28 |
| CVE-2026-78425 Authorised users of outside applications behind the same corporate identity prov... |
not reported | — | — | — | 2026-09-17 | 2026-09-28 |
| CVE-2026-78426 The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same... |
not reported | — | — | — | 2026-09-17 | 2026-09-28 |
| CVE-2026-78427 The NeuVector admission webhook silently excludes containers from policy evaluat... |
not reported | — | — | — | 2026-09-17 | 2026-09-28 |
| CVE-2026-78428 For users authenticated through SAML or OpenID Connect (OIDC), this vulnerabilit... |
not reported | — | — | — | 2026-09-17 | 2026-09-28 |
| CVE-2026-97521 In the Linux kernel, the following vulnerability has been resolved:
gfs2: fix q... |
not reported | — | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-97511 In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80... |
not reported | — | — | — | 2026-09-24 | 2026-09-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.