September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,321
Critical
1,226
High
4,361
Medium
4,108
Low
460
Severity not reported
1,166
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-55456 Rejected reason: This CVE is a duplicate of another CVE. |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-49865 Kimai is an open-source time tracking application. |
not reported | — | — | — | 2026-09-11 | 2026-09-23 |
| CVE-2026-49992 Kimai is an open-source time tracking application. |
not reported | — | — | — | 2026-09-11 | 2026-09-23 |
| CVE-2026-52819 Kimai is an open-source time tracking application. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-52820 Kimai is an open-source time tracking application. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-52822 Kimai is an open-source time tracking application. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-52823 Kimai is an open-source time tracking application. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-52825 Kimai is an open-source time tracking application. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-52826 Kimai is an open-source time tracking application. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-52828 Kimai is an open-source time tracking application. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-41573 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-44793 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-45051 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-46498 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-47424 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-48717 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-53660 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-62263 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-44203 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-46623 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-47426 Open Access Management (OpenAM) is an access management solution. |
not reported | — | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-77403 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-77404 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-77406 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-77407 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-77408 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-77410 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-77411 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-77412 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. |
not reported | — | — | — | 2026-09-16 | 2026-09-23 |
| CVE-2026-18944 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-54594 OmniBlocks is a monorepo for the OmniBlocks project. |
not reported | — | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-48977 OpenSlide is a C library for reading whole slide image files. |
not reported | — | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-54604 OpenSlide is a C library for reading whole slide image files. |
not reported | — | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-54343 Frappe Learning Management System (LMS) is a learning system that helps users st... |
not reported | — | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-63458 Perses is an open-source dashboard and visualization project for observability d... |
not reported | — | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-63647 CordysCRM is an open source AI-powered customer relationship management system t... |
not reported | — | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-91130 Home Assistant is open source home automation software focused on local control... |
not reported | — | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-63627 mppx is a TypeScript interface for machine payments protocol. |
not reported | — | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-76909 Unleash is an open-source feature management platform. |
not reported | — | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-77426 Unleash is an open-source feature management platform. |
not reported | — | — | — | 2026-09-22 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.