September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,314
Critical
1,226
High
4,360
Medium
4,108
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-97875 Rojo's "rojo serve" HTTP API (default port 34872) has no Host/Origin header vali... |
high | 8.1 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-52622 An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal... |
high | 7.5 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-79153 Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access contr... |
high | 7.8 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-88421 Incorrect access control in the BlogPage.get_entries() component of APSL puput v... |
high | 7.5 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-100389 GestSup versions before 3.2.62 contain a remote code execution vulnerability in... |
high | 8.1 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-100390 Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the... |
high | 7.4 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-100520 Laranode versions before 1.2.1 contain a path traversal vulnerability in the POS... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-101032 navi through 2.24.0 fails to properly escape cheatsheet variable values when sub... |
high | 7.0 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-101059 utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote O... |
high | 7.1 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-101060 python-utcp versions before 1.1.4 contain a server-side request forgery vulnerab... |
high | 8.2 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-93348 Unsloth Zoo versions 2025.9.9 before 2026.8.14, as implemented in Unsloth 2025.9... |
high | 8.1 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-102422 shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by... |
high | 8.1 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2015-20122 Seeyon A6 collaborative office automation platform contains an unauthenticated S... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102810 Marmite through 0.4.2 contains a path traversal vulnerability in the development... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102811 Marmite through 0.4.2 contains missing authentication in the development server... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102878 mcp-chrome-bridge through 1.0.31 contains an origin validation error in the nati... |
high | 8.1 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-103054 AiSOC versions before 12.0.0 contain an authorization bypass vulnerability in th... |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-10764 Information disclosure in BVMS 4.5 up to 12.3 including allows man-in-the-middle... |
high | 8.7 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-103398 OpenSave through 2.4.0 fails to properly validate save paths supplied by paired... |
high | 8.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-81516 Steeltoe is an open source project that provides a collection of libraries that... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-30 |
| CVE-2026-46655 virtio-win provides Windows paravirtualized drivers for QEMU and KVM. |
high | 7.8 | — | — | 2026-09-18 | 2026-09-30 |
| CVE-2026-100310 GNU libextractor before 1.16 loads plugins from an untrusted search path specifi... |
high | 7.0 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-97730 In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File I... |
high | 8.5 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-97731 MinIO through 7aac2a2 does not verify that every x-amz-* header present on a req... |
high | 7.1 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-51773 An issue in the VMware datastore driver of OpenStack glance_store. |
high | 8.1 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-100631 Parse Server is an open source backend server. |
high | 7.5 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100704 Kyverno is a policy engine for Kubernetes. |
high | 7.7 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-101043 pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} envi... |
high | 7.4 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-101044 pacquet, the Rust package-manager component shipped in the pnpm npm package vers... |
high | 7.1 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-93355 LiteLLM contains a weak authentication vulnerability that allows an attacker hol... |
high | 8.1 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-101878 Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102566 CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary mod... |
high | 7.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102875 VLC media player before 3.0.24 contains a path traversal vulnerability in the sk... |
high | 7.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-92867 An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an au... |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-92873 Pgpool-II contains an incorrect implementation of an authentication algorithm, w... |
high | 7.3 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-82538 ILIAS before versions 9.22, 10.10, and 11.3 contains a SQL injection vulnerabili... |
high | 8.8 | — | — | 2026-09-04 | 2026-09-30 |
| CVE-2026-103242 A heap-based buffer overflow flaw was found in rpm. |
high | 7.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-62813 Use after free in Active Directory Domain Services allows an authorized attacker... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-62810 Heap-based buffer overflow in Active Directory Certificate Services (AD CS) allo... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-92871 A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.