September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,314
Critical
1,226
High
4,360
Medium
4,108
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-97256 Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions. |
high | 7.2 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97290 Unauthenticated Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Fl... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-97291 Contributor PHP Object Injection in Schema & Structured Data for WP & AMP <= 1.6... |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-69272 Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attack... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-92916 Grav is a flat-file CMS. |
high | 7.5 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-88861 Capgo (Cap-go/capgo.app) contains an authentication bypass affecting all version... |
high | 8.3 | — | — | 2026-09-10 | 2026-09-30 |
| CVE-2026-88862 Capgo (capgo.app) backend through 12.242.4 does not validate parent-child delega... |
high | 8.8 | — | — | 2026-09-10 | 2026-09-30 |
| CVE-2026-75895 In libsmpp35 from 0.1.0 through 1.8.0 out of bound read issue was found in the a... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-30 |
| CVE-2026-47602 NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-47596 NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode... |
high | 7.0 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-47580 NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mod... |
high | 7.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-47575 NVIDIA GPU Display Driver for Windows contains a vulnerability in the display dr... |
high | 7.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-47576 NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mod... |
high | 7.7 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-47554 NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-47489 NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode... |
high | 7.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103088 Handlebars.java before 4.5.5 allows directory traversal. |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-102908 A vulnerability was determined in SourceCodester Online Reviewer Management Syst... |
high | 7.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103232 A weakness has been identified in AdithyaYelloju Restaurant-Management-System up... |
high | 7.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-101045 Fleet-maintained app install and uninstall scripts for macOS are generated from... |
high | 8.0 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100693 Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation... |
high | 8.4 | — | Gohugo / hugo | 2026-09-26 | 2026-09-30 |
| CVE-2026-100697 Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins... |
high | 8.6 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100617 Cap-go capgo.app fails to validate that principals in channel_permission_overrid... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100618 Capgo (capgo.app) is affected by an authorization flaw in the app icon update pa... |
high | 8.5 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100619 Capgo (capgo.app) blocks direct user inserts into the public.manifest table with... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100623 Capgo (capgo.app) exposes the legacy membership table public.org_users directly... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100625 Capgo (capgo.app) exposes a native build TUS upload proxy (supabase/functions/_b... |
high | 7.1 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100627 Capgo (Cap-go/capgo.app) server backend Supabase functions contain an incorrect... |
high | 8.1 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100387 pgPointcloud through 1.2.5 contains a heap out-of-bounds read vulnerability in d... |
high | 8.1 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-69271 Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attack... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-69269 Integer underflow (wrap or wraparound) in Microsoft Standard XPS allows an autho... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-68897 Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-68892 Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-68890 Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-68889 Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attack... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-81352 Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unautho... |
high | 8.8 | — | Microsoft / web media extensions | 2026-09-08 | 2026-09-30 |
| CVE-2026-49464 NL Portal Backend Libraries provide backend components for Dutch government port... |
high | 8.1 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-49846 libks provides foundational support for signalwire C products. |
high | 7.5 | — | — | 2026-09-11 | 2026-09-30 |
| CVE-2026-59960 Argos JavaScript provides official Argos SDKs for JavaScript. |
high | 7.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54178 backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpa... |
high | 8.1 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54180 backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpa... |
high | 7.6 | — | — | 2026-09-14 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.