September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,321
Critical
1,226
High
4,361
Medium
4,108
Low
460
Severity not reported
1,166
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-97151 mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97152 Nanomsg versions 0.5-beta through 1.x before 1.2.3 has a remotely exploitable bu... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96269 GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file,... |
not reported | — | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-13016 ServiceNow has remediated a SQL injection vulnerability that was identified in t... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-86858 ServiceNow has remediated an improper access control security issue that was ide... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-86859 ServiceNow has remediated an authorization bypass security issue that was identi... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96770 All published s2s-proxy versions through 0.2.2 are affected. |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-4637 Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a refl... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-4638 PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-12559 A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenTex... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-96872 Improper handling of insufficient permissions or privileges vulnerability in The... |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-96873 Improper neutralization of input during web page generation ('cross-site scripti... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-63646 CordysCRM is an open source AI-powered customer relationship management system t... |
not reported | — | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-91187 Improper Verification of Cryptographic Signature vulnerability in dashbit nimble... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-94604 Rejected reason: This CVE is a duplicate of another CVE. |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-82405 Klever-Go is the Go implementation of the Klever blockchain protocol. |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-82406 Klever-Go is the Go implementation of the Klever blockchain protocol. |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-82409 Klever-Go is the Go implementation of the Klever blockchain protocol. |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-67238 RabbitMQ is a messaging and streaming broker. |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-67240 RabbitMQ is a messaging and streaming broker. |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-66069 RabbitMQ is a messaging and streaming broker. |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-63628 mppx is a TypeScript interface for machine payments protocol. |
not reported | — | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-66067 RabbitMQ is a messaging and streaming broker. |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-5695 Arbitrary file upload vulnerability due to a lack of proper validation in upload... |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-5696 Reflected Cross-Site Scripting (XSS) in Microweber. |
not reported | — | — | — | 2026-09-23 | 2026-09-24 |
| CVE-2026-7169 a vulnerability involving an unchecked search path element in Evope Collector, v... |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-97168 Rejected reason: it is a suggestion |
not reported | — | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-57168 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-92692 Sulu is an open-source PHP content management system based on the Symfony framew... |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-92730 LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vu... |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-90900 Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefron... |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-90903 Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Admin... |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-90904 Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiCon... |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-90905 Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Conf... |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-90899 Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Gue... |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-85055 Twenty is an open-source CRM (customer relationship management) platform. |
not reported | — | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-82407 Klever-Go is the Go implementation of the Klever blockchain protocol. |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-76910 Unleash is an open-source feature management platform. |
not reported | — | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-54608 MythicalDash is a Pterodactyl client area. |
not reported | — | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-19202 A caching flaw in the toolbox-core package of the mcp-toolbox-sdk-python SDK cau... |
not reported | — | — | — | 2026-09-22 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.