September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,314
Critical
1,226
High
4,360
Medium
4,108
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-54567 Flask-Reuploaded provides file uploads for Flask. |
high | 7.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-55091 flat-to-nested converts a hierarchy from a flat representation to a nested repre... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-73494 blaze is a Scala library for building asynchronous pipelines, with a focus on ne... |
high | 7.4 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54447 garminconnect is a Python 3 API wrapper for Garmin Connect that retrieves statis... |
high | 8.4 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54628 Anyquery is an SQL query engine built on top of SQLite. |
high | 8.6 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54629 Anyquery is an SQL query engine built on top of SQLite. |
high | 7.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54632 SIPSorcery is a WebRTC, SIP, and VoIP library for C# and .NET. |
high | 7.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-73496 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 7.7 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-53957 Contentful MCP Server is a Model Context Protocol server for the Contentful Mana... |
high | 7.7 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55178 GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and S... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-57586 CodeRAG is a lightweight semantic code search and distillation utility for AI co... |
high | 8.6 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54076 ArcadeDB is a Multi-Model DBMS. |
high | 8.1 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54077 ArcadeDB is a Multi-Model DBMS. |
high | 7.1 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-59965 Payload Plugins is a collection of plugins designed to enhance Payload CMS. |
high | 7.1 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-59973 FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). |
high | 8.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-65831 ArcadeDB is a Multi-Model DBMS. |
high | 7.7 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55149 Vouch Proxy is an SSO and OAuth/OIDC login solution for Nginx using the auth_req... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55690 The EmbedVideo Extension is a MediaWiki extension which adds a parser function c... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55691 The EmbedVideo Extension is a MediaWiki extension which adds a parser function c... |
high | 8.6 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55692 The EmbedVideo Extension is a MediaWiki extension which adds a parser function c... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-58200 Payload Plugins is a collection of plugins designed to enhance Payload CMS. |
high | 7.1 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-59160 Yeger is a monorepo for npm packages maintained under the yeger scope. |
high | 8.8 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54547 Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants ru... |
high | 7.4 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54549 Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants ru... |
high | 8.3 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-56825 Shopper is a Headless e-commerce Admin Panel. |
high | 8.1 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-56827 Shopper is a Headless e-commerce Admin Panel. |
high | 8.1 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-56829 Shopper is a Headless e-commerce Admin Panel. |
high | 8.1 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-58483 mcp-searxng is a Model Context Protocol server that gives AI assistants web sear... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-58485 mcp-searxng is a Model Context Protocol server that gives AI assistants web sear... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-61668 DIRAC is an interware, meaning a software framework for distributed computing. |
high | 8.1 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-54544 Fireshare facilitates self-hosted media and link sharing. |
high | 7.2 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-61554 emp3r0r is a C2 designed by Linux users for Linux environments. |
high | 7.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-88065 `tts-be` is a backend for a timetable selector that aims to help students better... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-61590 djust provides Phoenix LiveView-style reactive server-side rendering for Django... |
high | 7.4 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-63127 RMCP is an official Rust SDK for the Model Context Protocol. |
high | 8.2 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-63128 RMCP is an official Rust SDK for the Model Context Protocol. |
high | 7.5 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-61593 djust provides Phoenix LiveView-style reactive server-side rendering for Django... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-61595 djust provides Phoenix LiveView-style reactive server-side rendering for Django... |
high | 7.7 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-63506 Tina is a headless content management system. |
high | 8.8 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-61591 djust provides Phoenix LiveView-style reactive server-side rendering for Django... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.