September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,321
Critical
1,226
High
4,361
Medium
4,108
Low
460
Severity not reported
1,166
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100612 Capgo (capgo.app) through version 12.261.0 contains an incomplete access-control... |
high | 7.2 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100288 Cleartext storage of sensitive information in the database in Devolutions Server... |
high | 7.2 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-100241 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wiki... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-100244 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wiki... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-69275 Use after free in Kernel Streaming WOW Thunk Service Driver allows an authorized... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-69277 Stack-based buffer overflow in Microsoft Local Security Authority Server (lsasrv... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-69292 Double free in Remote Desktop Gateway Service allows an authorized attacker to e... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-76111 Dell PowerStore contains an Incorrect Authorization vulnerability. |
high | 8.8 | — | Dell / powerstoreos | 2026-09-01 | 2026-09-30 |
| CVE-2026-58575 Dell PowerStore contains an Authentication Bypass by Spoofing vulnerability. |
high | 8.8 | — | Dell / powerstoreos | 2026-09-01 | 2026-09-30 |
| CVE-2026-79683 Dell PowerStore contains a Protection Mechanism Failure vulnerability. |
high | 8.8 | — | Dell / powerstoreos | 2026-09-01 | 2026-09-30 |
| CVE-2026-95306 Type confusion in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-92870 A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-90783 MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib l... |
high | 7.8 | — | — | 2026-09-13 | 2026-09-30 |
| CVE-2026-91096 In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminat... |
high | 7.5 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-88816 DBI versions before 1.654 for Perl incorrectly treat numeric values as strings i... |
high | 7.5 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-85644 XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an a... |
high | 7.5 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-67993 basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f contains a l... |
high | 8.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-74225 U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_op... |
high | 7.1 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-61519 Liberu CRM 0.9.1 before 10.0.0 contains a broken access control vulnerability th... |
high | 8.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-103432 apcupsd through 3.14.14 has an sscanf stack-based buffer overflow in getupsvar()... |
high | 8.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103471 restbed through 5.0.0 buffers HTTP request headers without enforcing a maximum s... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103230 A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up... |
high | 7.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102925 virtualenv is a tool for creating isolated virtual python environments. |
high | 7.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102728 Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a ser... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102717 MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102253 iperf3 versions prior to 3.22 contains a denial of service vulnerability that al... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-71416 Headroom compresses data before the data reaches a large language model. |
high | 8.8 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-54135 AirSane is a SANE frontend, and a scanner server that supports Apple's AirScan p... |
high | 7.5 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-54166 Shelf is a platform for tracking physical assets. |
high | 7.1 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-54174 melange allows users to build apk packages using declarative pipelines. |
high | 8.3 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-50013 Hoverfly is an open source API simulation tool. |
high | 7.5 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-54240 libde265 is an open source implementation of the h.265 video codec. |
high | 7.4 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-54241 libde265 is an open source implementation of the h.265 video codec. |
high | 7.4 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-57129 PraisonAI is a multi-agent teams system. |
high | 7.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-57579 Alchemy is an open source content management system engine written in Ruby on Ra... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-53659 http4k is a functional toolkit for Kotlin HTTP applications. |
high | 7.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54087 EasyAdmin is a fast and modern admin generator for Symfony applications. |
high | 7.6 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54175 backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpa... |
high | 7.6 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54182 backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpa... |
high | 8.1 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-76086 Formie is a Craft CMS plugin for creating forms. |
high | 8.5 | — | — | 2026-09-23 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.