September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,364
Critical
1,230
High
4,374
Medium
4,126
Low
462
Severity not reported
1,172
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-24061 GNU InetUtils Argument Injection Vulnerability |
critical | 9.8 | Listed | GNU / InetUtils | 2026-01-21 | 2026-09-30 |
| CVE-2026-96587 The Viidure Android application embeds permanent, plaintext cloud storage creden... |
critical | 10.0 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-88777 Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix N... |
critical | 9.8 | — | Citrix / netscaler application delivery controller | 2026-09-27 | 2026-09-29 |
| CVE-2026-100291 In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, several ONVIF service endpoi... |
critical | 9.8 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-8065 An authentication bypass vulnerability in the firmware update endpoint of Hitach... |
critical | 9.1 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-8066 A directory traversal vulnerability in the file upload functionality of Hitachi... |
critical | 9.1 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-100741 Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's... |
critical | 9.8 | — | — | 2026-09-27 | 2026-09-29 |
| CVE-2026-82973 Improper neutralization of CRLF sequences in IMAP command construction in psyb0t... |
critical | 9.4 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-88804 An unauthenticated update of public UI settings could be used by remote attacker... |
critical | 9.6 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-93641 An unauthenticated sender can forge a share notification that triggers stored XS... |
critical | 9.3 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-93642 An unauthenticated sender can forge a share notification that triggers stored XS... |
critical | 9.3 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-93643 When OnlyOffice/Document Editing is available, an unauthenticated remote attacke... |
critical | 9.8 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-93647 An unauthenticated calendar sender can place active markup in a COUNTER message'... |
critical | 9.3 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-39117 An issue in AltumCode 66Uptime before v.54.0.0 and 66Uptime ping-servers plugin... |
critical | 9.8 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-79538 metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution i... |
critical | 9.8 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-70748 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware... |
critical | 9.8 | — | Oracle / weblogic server | 2026-09-15 | 2026-09-29 |
| CVE-2026-62262 Piwigo is a full featured open source photo gallery application for the web. |
critical | 9.1 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-101187 A weakness has been identified in Ziroom ZHOME A0101 1.0.1.0. |
critical | 9.1 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-101260 A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. |
critical | 9.1 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-101263 A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. |
critical | 9.1 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-55158 Conflibot warns in advance when merging a pull request will cause conflicts in o... |
critical | 9.1 | — | — | 2026-09-15 | 2026-09-29 |
| CVE-2026-45143 Chamilo LMS is an open-source learning management system. |
critical | 9.0 | — | — | 2026-09-17 | 2026-09-29 |
| CVE-2026-88056 Angular is a development platform for building mobile and desktop web applicatio... |
critical | 9.1 | — | Angular / angular | 2026-09-10 | 2026-09-29 |
| CVE-2026-101262 A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. |
critical | 9.1 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-101354 A security flaw has been discovered in FAST FAC1203R 20200116_2.0.4. |
critical | 9.6 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102240 A vulnerability was found in Netcore NAP930 0.1.241010.141410. |
critical | 10.0 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-69865 Authorization bypass through user-controlled key in Microsoft Container Registry... |
critical | 10.0 | — | Microsoft / azure container registry | 2026-09-17 | 2026-09-29 |
| CVE-2026-87701 Improper neutralization of special elements in output used by a downstream compo... |
critical | 9.6 | — | Microsoft / azure cosmos db | 2026-09-17 | 2026-09-29 |
| CVE-2026-65121 NVIDIA Infrastructure Controller for Linux contains a vulnerability where an att... |
critical | 9.8 | — | Nvidia / infra controller | 2026-09-22 | 2026-09-29 |
| CVE-2026-65118 NVIDIA Infrastructure Controller for Linux contains a vulnerability where an att... |
critical | 9.8 | — | Nvidia / infra controller | 2026-09-22 | 2026-09-29 |
| CVE-2026-65114 NVIDIA Infrastructure Controller for Linux contains a vulnerability where an att... |
critical | 9.8 | — | Nvidia / infra controller | 2026-09-22 | 2026-09-29 |
| CVE-2026-65113 NVIDIA Infrastructure Controller for Linux contains a vulnerability where an att... |
critical | 9.8 | — | Nvidia / infra controller | 2026-09-22 | 2026-09-29 |
| CVE-2026-88776 Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix N... |
critical | 9.8 | — | Citrix / netscaler application delivery controller | 2026-09-27 | 2026-09-29 |
| CVE-2026-88773 Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling')... |
critical | 10.0 | — | Citrix / netscaler application delivery controller | 2026-09-27 | 2026-09-29 |
| CVE-2026-88775 Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gatew... |
critical | 9.8 | — | Citrix / netscaler application delivery controller | 2026-09-27 | 2026-09-29 |
| CVE-2026-82377 Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to rea... |
critical | 9.9 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-82378 Incorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Rolle... |
critical | 9.0 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-51996 An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to... |
critical | 9.8 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2022-25863 The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vu... |
critical | 9.8 | — | Gatsbyjs / gatsby-plugin-mdx | 2022-06-10 | 2026-09-29 |
| CVE-2026-65130 NVIDIA Infrastructure Controller for Linux contains a vulnerability where an att... |
critical | 9.8 | — | Nvidia / infra controller | 2026-09-22 | 2026-09-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.