September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,314
Critical
1,226
High
4,360
Medium
4,108
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-96326 The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPres... |
high | 7.2 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-92370 An improper access control vulnerability in TeamViewer Full Client, Host, and re... |
high | 8.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-92371 TeamViewer Full Client and Host for Linux prior version 15.82 contains an improp... |
high | 7.0 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-92368 TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain... |
high | 7.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-92369 TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCT... |
high | 7.3 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-86450 Insertion of sensitive information into sent data vulnerability in Parla Auto Au... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-89294 The Simply Schedule Appointments plugin for WordPress is vulnerable to Local Fil... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-86158 Missing authentication in the local .NET backend (Fiddler.WebUi) of Progress Sof... |
high | 7.7 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-75098 The Product Designer App plugin for WordPress is vulnerable to Directory Travers... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-18783 Missing authentication for critical function vulnerability in Trex Digital Smart... |
high | 8.8 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-6806 The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-65102 NVIDIA DeepStream contains a vulnerability where an attacker could cause an inte... |
high | 7.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-62097 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-19743 Improper path validation in the local IPC service of TeamViewer Full Client and... |
high | 7.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-103270 LightLLM through 1.2.0 mounts reinforcement learning control routes on the publi... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-100870 Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build admini... |
high | 8.8 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100871 Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to incl... |
high | 8.8 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100851 AzuraCast before 0.23.8 contains a broken access control vulnerability in the GE... |
high | 7.6 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100843 MONAI versions before 1.6.0 contain a remote code execution vulnerability in the... |
high | 7.8 | — | Project-monai / monai | 2026-09-27 | 2026-09-30 |
| CVE-2026-100847 AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder... |
high | 7.5 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100850 AzuraCast before 0.23.8 contains a server-side request forgery and local file re... |
high | 7.7 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100744 A flaw has been found in coollabsio Coolify up to 4.1.2. |
high | 7.3 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100835 Contrast before 1.16.0 is susceptible to remote attestation relay attacks. |
high | 7.4 | — | — | 2026-09-27 | 2026-09-30 |
| CVE-2026-100690 Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css... |
high | 7.5 | — | Gohugo / hugo | 2026-09-26 | 2026-09-30 |
| CVE-2026-100308 Deserialization of untrusted data in the model loading component in Amazon Gluon... |
high | 7.8 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-93994 Apache MINA SSHD is a Java library for client-side and server-side SSH. |
high | 8.1 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-94002 Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd... |
high | 7.5 | — | — | 2026-09-30 | 2026-09-30 |
| CVE-2026-100840 MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle... |
high | 7.8 | — | Project-monai / monai | 2026-09-27 | 2026-09-30 |
| CVE-2026-100844 MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner c... |
high | 7.8 | — | Project-monai / monai | 2026-09-27 | 2026-09-30 |
| CVE-2026-93306 IBM Server Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW... |
high | 7.1 | — | Ibm / power system e1080 \(9080-hex\) firmware | 2026-09-25 | 2026-09-30 |
| CVE-2026-100845 MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the Numpy... |
high | 7.8 | — | Project-monai / monai | 2026-09-27 | 2026-09-30 |
| CVE-2026-77762 Concurrent Execution using Shared Resource with Improper Synchronization ('Race... |
high | 8.1 | — | — | 2026-09-23 | 2026-09-30 |
| CVE-2026-102335 Nginx Proxy Manager through 2.16.0 fails to restrict the advanced_config field t... |
high | 7.1 | — | — | 2026-09-28 | 2026-09-30 |
| CVE-2026-100662 Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100666 Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final thro... |
high | 7.3 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100670 Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100646 SiYuan is a self-hosted personal knowledge management system. |
high | 8.1 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100642 SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery v... |
high | 7.6 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-102317 Improper privilege management in Mojo in Google Chrome on on Windows prior to 15... |
high | 8.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102321 Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.