September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,314
Critical
1,226
High
4,360
Medium
4,108
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-61592 djust provides Phoenix LiveView-style reactive server-side rendering for Django... |
high | 7.4 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-61596 djust provides Phoenix LiveView-style reactive server-side rendering for Django... |
high | 7.1 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-77614 Opencast is a free, open-source platform to support the management of educationa... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-54446 NetLicensing MCP Server is a natural-language interface that enables agentic app... |
high | 8.1 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-52727 lxc-ci contains continuous integration and image-build scripts for LXC. |
high | 7.2 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-52851 Traccar is an open source GPS tracking system. |
high | 7.1 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-54504 MCP Documentation Server is a local-first document management and semantic searc... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-63443 Coder allows organizations to provision remote development environments via Terr... |
high | 8.3 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-68904 node-opcua is an OPC UA implementation for TypeScript and Node.js. |
high | 7.0 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-85756 SSH.NET is a Secure Shell (SSH) library for .NET. |
high | 7.5 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-85715 ExifReader is a JavaScript Exif information parser. |
high | 7.5 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-86038 libp2p is a JavaScript implementation of the libp2p networking stack. |
high | 7.5 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-100841 In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the... |
high | 7.8 | — | Project-monai / monai | 2026-09-27 | 2026-09-30 |
| CVE-2026-100842 MONAI through 1.6.0 contains an eval injection vulnerability in _get_fake_spatia... |
high | 8.8 | — | Project-monai / monai | 2026-09-27 | 2026-09-30 |
| CVE-2026-50270 dd-trace-java is a Datadog APM client for Java. |
high | 7.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-53752 docx4j is an open source Java library for creating, editing, and saving OpenXML... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-55253 LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and L... |
high | 7.7 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-53714 Envoy Gateway is an open source project for managing Envoy Proxy as a standalone... |
high | 7.4 | — | — | 2026-09-14 | 2026-09-30 |
| CVE-2026-54167 Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in s... |
high | 8.2 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-55225 Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift... |
high | 8.0 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-76820 OpenCTI is an open source platform for managing cyber threat intelligence knowle... |
high | 7.7 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-84997 react/http is an event-driven, streaming HTTP client and server implementation f... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-59974 Stanza is a Stanford NLP Python library for tokenization, sentence segmentation,... |
high | 7.8 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-63126 Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. |
high | 7.5 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-81875 HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare i... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-81876 HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare i... |
high | 7.5 | — | — | 2026-09-16 | 2026-09-30 |
| CVE-2026-85721 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-54253 TS3 Manager is modern web interface for maintaining Teamspeak3 servers. |
high | 8.2 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-50125 MKP is a Model Context Protocol server for Kubernetes. |
high | 7.5 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-54596 ITFlow provides an IT documentation, ticketing and accounting system for small m... |
high | 8.1 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-61833 zot is a container image and artifact registry based on the Open Container Initi... |
high | 8.1 | — | — | 2026-09-18 | 2026-09-30 |
| CVE-2026-62279 LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel... |
high | 7.1 | — | — | 2026-09-18 | 2026-09-30 |
| CVE-2026-63330 Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. |
high | 7.7 | — | — | 2026-09-21 | 2026-09-30 |
| CVE-2026-59990 Jawn is an open source JSON parser. |
high | 7.5 | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-61814 Jawn is an open source JSON parser. |
high | 7.5 | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-76087 Formie is a Craft CMS plugin for creating forms. |
high | 8.2 | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-76089 Formie is a Craft CMS plugin for creating forms. |
high | 7.7 | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-61816 zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* funct... |
high | 7.5 | — | — | 2026-09-24 | 2026-09-30 |
| CVE-2026-97735 ITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/tick... |
high | 8.0 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-97737 In Wakapi before 2.17.6, the user caching service allows a lookup to be resolved... |
high | 7.4 | — | — | 2026-09-25 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.