September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,321
Critical
1,226
High
4,361
Medium
4,108
Low
460
Severity not reported
1,166
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-61782 Rsdoctor is a build analyzer tailored for projects built with Rspack. |
high | 7.5 | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-61788 DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB,... |
high | 7.4 | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-57440 The EmbedVideo Extension is a MediaWiki extension which adds a parser function c... |
high | 7.5 | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-61823 code16 Sharp is a Laravel-based framework for building content-management and ad... |
high | 7.3 | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-91837 A flaw was found in NetworkManager-iodine, the iodine VPN plugin for NetworkMana... |
high | 7.8 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-91838 A flaw was found in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager. |
high | 7.8 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-91839 A flaw was found in NetworkManager-fortisslvpn, the FortiSSLVPN plugin for Netwo... |
high | 7.8 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-91840 A flaw was found in NetworkManager-vpnc. |
high | 7.8 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-91841 A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. |
high | 7.8 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-100368 CliInvoke is a .NET library for invoking command-line programs, and its `CliInvo... |
high | 8.4 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-100369 CliInvoke and its formerly named `AlastairLundy.CliInvoke` package are .NET libr... |
high | 8.4 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-57443 SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. |
high | 7.5 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-55160 Stringer is a self-hosted, anti-social RSS reader. |
high | 7.6 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-84894 In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps usin... |
high | 7.5 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-102276 The brace-expansion library generates arbitrary strings containing a common pref... |
high | 7.5 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-63209 compress provides various compression algorithms. |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-79625 Affected products do not properly synchronize access to their monitoring functio... |
high | 8.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-76992 The CODESYS Gateway Client allocates memory based on a size field in a gateway r... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-46711 Soft Machine is a Virtual Machine–based agentic development environment / Cloud... |
high | 8.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-87004 Tugtainer is a self-hosted app for automating updates of Docker containers. |
high | 8.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-10758 Esri LERC is an open-source image or raster format which supports rapid encoding... |
high | 7.5 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-54160 Network UPS Tools is a collection of programs which provide a common interface f... |
high | 8.2 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-102281 Nest is a framework for building scalable Node.js server-side applications. |
high | 7.5 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-95298 Use after free in Browser in Google Chrome prior to 154.0.8037.57 allowed a loca... |
high | 7.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95304 Out of bounds write in V8 in Google Chrome prior to 154.0.8037.57 allowed a remo... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-54155 node-opcua is an OPC UA implementation for TypeScript and Node.js. |
high | 7.7 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54156 node-opcua is an OPC UA implementation for TypeScript and Node.js. |
high | 7.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-61695 Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. |
high | 7.5 | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-71540 Wazuh is an open-source security platform providing unified XDR and SIEM protect... |
high | 7.5 | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-102360 A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and... |
high | 8.6 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102600 Socket.IO enables bidirectional and low-latency communication for every platform... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-70658 Pay is a payments engine for Ruby on Rails 6.0 and higher. |
high | 7.4 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-61701 Laravel MagicLink creates links for authentication without a password or for acc... |
high | 8.8 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-47253 Anyquery is an SQL query engine built on top of SQLite. |
high | 7.3 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-103474 yii2-starter-kit through 4.2.0 fails to validate file types in the backend stora... |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-100510 Unauthenticated Cross Site Scripting (XSS) in Post and Page Builder by BoldGrid... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102376 Subscriber Cross Site Scripting (XSS) in Branda <= 3.4.32 versions. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102377 Contributor PHP Object Injection in Photo Gallery by 10Web <= 1.8.46 versions. |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102391 Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.4 versions... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102392 Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Cus... |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.