September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,321
Critical
1,226
High
4,361
Medium
4,108
Low
460
Severity not reported
1,166
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-8763 In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot... |
critical | 9.1 | — | Bouncycastle / bc-java | 2026-08-03 | 2026-09-02 |
| CVE-2026-84795 Craft CMS before 5.10.11 fails to validate the admin flag during user registrati... |
critical | 9.8 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-84803 SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in ass... |
critical | 9.0 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-9055 The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for W... |
critical | 9.8 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-78657 The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to ar... |
critical | 9.8 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-81294 Unauthenticated Privilege Escalation in Authorizer <= 3.15.1 versions. |
critical | 9.8 | — | — | 2026-09-02 | 2026-09-02 |
| CVE-2026-53622 Traefik is an HTTP reverse proxy and load balancer. |
critical | 10.0 | — | Traefik / traefik | 2026-06-23 | 2026-09-02 |
| CVE-2026-48491 Traefik is an HTTP reverse proxy and load balancer. |
critical | 10.0 | — | Traefik / traefik | 2026-06-23 | 2026-09-02 |
| CVE-2026-48020 Traefik is an HTTP reverse proxy and load balancer. |
critical | 10.0 | — | Traefik / traefik | 2026-06-23 | 2026-09-02 |
| CVE-2026-19478 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2... |
critical | 9.1 | — | Gitlab / gitlab | 2026-08-17 | 2026-09-02 |
| CVE-2026-18931 Use of Hard-coded Credentials vulnerability in TMT Machine Industry and Trade Lt... |
critical | 9.1 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-51743 Incorrect access control in the guest_wifi_sync function of TOTOLINK T6 4.1.5cu.... |
critical | 9.1 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-75865 The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Go... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-83772 A vulnerability was detected in Cobham SATCOM VSAT7090 Maritime Satellite Router... |
critical | 9.9 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-59270 Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditio... |
critical | 9.1 | — | Vmware / spring security | 2026-08-27 | 2026-09-01 |
| CVE-2026-75871 GitLab has remediated a vulnerability in the GitLab AI Gateway component affecti... |
critical | 9.6 | — | Gitlab / gitlab | 2026-08-27 | 2026-09-01 |
| CVE-2026-77070 n8n before 1.123.69, 2.33.4, and 2.34.1 contains a NoSQL injection vulnerability... |
critical | 9.8 | — | N8n / n8n | 2026-08-20 | 2026-09-01 |
| CVE-2026-77071 n8n before 1.123.69, 2.33.4, and 2.34.1 contains a PostgREST filter injection vu... |
critical | 9.8 | — | N8n / n8n | 2026-08-20 | 2026-09-01 |
| CVE-2026-65081 NVIDIA NemoClaw for Linux contains a vulnerability in its installation process,... |
critical | 9.8 | — | Nvidia / nemoclaw | 2026-08-25 | 2026-09-01 |
| CVE-2026-65098 NVIDIA NemoClaw for Linux contains a vulnerability in its remote-access helper w... |
critical | 9.8 | — | Nvidia / nemoclaw | 2026-08-25 | 2026-09-01 |
| CVE-2019-3774 Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were... |
critical | 9.8 | — | Broadcom / spring batch | 2019-01-18 | 2026-09-01 |
| CVE-2026-65084 NVIDIA NemoClaw for Linux contains a vulnerability in its deployment process, wh... |
critical | 9.8 | — | Nvidia / nemoclaw | 2026-08-25 | 2026-09-01 |
| CVE-2026-18808 Improper Control of Generation of Code ('Code Injection') vulnerability in Klems... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-18765 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-18210 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-01 |
| CVE-2026-39932 OpenEMR through 8.2.0 contains a remote code execution vulnerability in the docu... |
critical | 9.1 | — | Open-emr / openemr | 2026-08-03 | 2026-09-01 |
| CVE-2026-101062 Obot before v0.23.0 (affected versions <= v0.22.1) running with OBOT_SERVER_ENAB... |
high | 8.8 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100888 A weakness has been identified in Trusted Domain Project OpenDKIM up to 2.11.0. |
high | 7.3 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-100885 A vulnerability was found in Krayin laravel-crm up to 2.2.4. |
high | 7.3 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-91149 A flaw was found in Cockpit. |
high | 7.5 | — | — | 2026-09-18 | 2026-09-30 |
| CVE-2026-47097 AJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerabi... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97059 DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoad... |
high | 8.2 | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-94954 A stack-based buffer overflow vulnerability exists in the web management interfa... |
high | 8.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-94953 A stack-based buffer overflow vulnerability exists in the web management interfa... |
high | 8.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-86330 An OS command injection flaw was found in the set_hostname_internal function of... |
high | 7.2 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-79403 An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary... |
high | 8.4 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102758 The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-leng... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102521 The decoder in `readFromDataView` in lib0 before 0.2.119 can be tricked into rea... |
high | 8.6 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-100669 Grav before 2.0.25 ships web server configuration samples whose access-control d... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100673 The Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 th... |
high | 8.2 | — | — | 2026-09-26 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.