September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,321
Critical
1,226
High
4,361
Medium
4,108
Low
460
Severity not reported
1,166
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-55074 Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeB... |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-91167 Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-61647 NotebookLM MCP is an MCP server and HTTP service for interacting with Google Not... |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-61652 Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of... |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-61851 Chartbrew is an open-source web application that can connect directly to databas... |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-75510 Novu provides an API for sending notifications through multiple channels. |
not reported | — | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-77619 Vector is a high-performance observability data pipeline. |
not reported | — | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-77620 Vector is a high-performance observability data pipeline. |
not reported | — | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-55556 Rsyslog is a rocket-fast system for log processing. |
not reported | — | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-83803 Sentry is an error tracking and performance monitoring tool. |
not reported | — | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-52836 OpenDDS is an open source C++ implementation of the Object Management Group (OMG... |
not reported | — | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-73863 NanoMQ is an MQTT broker. |
not reported | — | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-53534 JabRef is a desktop application for managing BibTeX and BibLaTeX libraries. |
not reported | — | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-52740 GoCD is a continuous deliver server. |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-52742 GoCD is a continuous deliver server. |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-55870 GoCD is a continuous deliver server. |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-68956 Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP... |
not reported | — | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-65634 Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER deco... |
not reported | — | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-54577 mport is the MidnightBSD Package Manager. |
not reported | — | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54579 mport is the MidnightBSD Package Manager. |
not reported | — | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54580 mport is the MidnightBSD Package Manager. |
not reported | — | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54642 CubeCart is an ecommerce software solution. |
not reported | — | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-77405 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. |
not reported | — | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-77409 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. |
not reported | — | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-75516 The RabbitMQ Java client library allows Java and JVM-based applications to conne... |
not reported | — | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-54451 Elixir protobuf is a pure Elixir implementation of Google Protobuf. |
not reported | — | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54633 PoDoFo is a C++17 PDF manipulation library. |
not reported | — | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-55563 Feast is the open source feature store for AI and machine learning. |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-61674 Fluent Bit is a fast and lightweight logs, metrics, and traces processor for Lin... |
not reported | — | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-68490 Incorrect permission assignment allows local users to obtain sensitive CalDAV/Ca... |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-68492 An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 an... |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-87898 OS command injection in Plesk allows remote authenticated users to execute arbit... |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-87899 Execution with unnecessary privileges in cPanel allows remote authenticated user... |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-87900 Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remo... |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96609 Robur Albatross 1.0.0 through 2.x before 2.7.2 does not limit use of the ring bu... |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-79616 Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Contex... |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-78253 Uncontrolled recursion in QXmlStreamReader::readElementText() in Qt Group Qt all... |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-11744 An input validation vulnerability exists in the PaperCut Hive embedded applicati... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-79680 Authentication bypass vulnerability in the password authentication mechanism of... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-90481 In PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.