September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,321
Critical
1,226
High
4,361
Medium
4,108
Low
460
Severity not reported
1,166
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-55775 OpenBao is an open source identity-based secrets management system. |
not reported | — | — | — | 2026-09-15 | 2026-09-25 |
| CVE-2026-93477 Improperly Controlled Modification of Dynamically-Determined Object Attributes v... |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-84445 gRPC-Go is the Go language implementation of gRPC. |
not reported | — | — | — | 2026-09-14 | 2026-09-25 |
| CVE-2026-53495 containerd is an open-source container runtime. |
not reported | — | — | — | 2026-09-14 | 2026-09-25 |
| CVE-2026-63349 AnyIO is a high level asynchronous concurrency and networking framework that wor... |
not reported | — | — | — | 2026-09-18 | 2026-09-25 |
| CVE-2026-6082 Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management... |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-6083 Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management... |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-6084 Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management... |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-6085 Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management... |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-6086 Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management... |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-6087 Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management... |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-6088 Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management... |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-92106 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-97443 In the Linux kernel, the following vulnerability has been resolved:
perf/ftrace... |
not reported | — | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-97447 In the Linux kernel, the following vulnerability has been resolved:
ACPICA: Enh... |
not reported | — | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-97426 In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/... |
not reported | — | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-97431 In the Linux kernel, the following vulnerability has been resolved:
drm/amd/dis... |
not reported | — | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-97423 In the Linux kernel, the following vulnerability has been resolved:
cxl/region:... |
not reported | — | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-97410 In the Linux kernel, the following vulnerability has been resolved:
netconsole:... |
not reported | — | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-97414 In the Linux kernel, the following vulnerability has been resolved:
ASoC: media... |
not reported | — | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-93818 In the Linux kernel, the following vulnerability has been resolved:
PCI: plda:... |
not reported | — | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-93809 In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu:... |
not reported | — | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-86857 ServiceNow has remediated an authorization bypass security issue that was identi... |
not reported | — | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-50227 An unauthenticated local attacker can connect to the MQTT broker over its localh... |
not reported | — | — | — | 2026-09-23 | 2026-09-25 |
| CVE-2026-50228 An unauthenticated local attacker can connect to the Electron DevTools endpoint... |
not reported | — | — | — | 2026-09-23 | 2026-09-25 |
| CVE-2026-97622 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-09-25 | 2026-09-25 |
| CVE-2026-86860 ServiceNow has remediated a missing authorization vulnerability that was identif... |
not reported | — | — | — | 2026-09-24 | 2026-09-25 |
| CVE-2026-94572 In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate... |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-76898 draw.io is a configurable diagramming and whiteboarding application. |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-61852 Chartbrew is an open-source web application that can connect directly to databas... |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-52741 GoCD is a continuous deliver server. |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-54571 ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32... |
not reported | — | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-55061 uniget is a universal installer and updater for (container) tools. |
not reported | — | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54237 Wavelog is web-based amateur radio logging software. |
not reported | — | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54501 Browsertrix is a high-fidelity, browser-based crawling service for web archiving... |
not reported | — | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-62943 btrbk is a tool for creating snapshots and remote backups of Btrfs subvolumes. |
not reported | — | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-77339 Process Compose is a scheduler and orchestrator for non-containerized applicatio... |
not reported | — | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-81505 Convoy is a cloud native webhooks gateway. |
not reported | — | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-63445 Perses is an open-source dashboard and visualization project for observability d... |
not reported | — | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-64847 AnyIO is a high level asynchronous concurrency and networking framework that wor... |
not reported | — | — | — | 2026-09-18 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.