September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,313
Critical
1,226
High
4,359
Medium
4,108
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2022-51019 Akaunting before 2.1.31 contains an OS command injection vulnerability in the mo... |
high | 8.8 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102334 Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoin... |
high | 7.4 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-78424 Improper parameter handling in NeuVector allows any authenticated user who holds... |
high | 8.8 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-88805 Incorrect credential cleaning on logout could be used by remote attackers to kee... |
high | 8.1 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-102697 Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerab... |
high | 7.8 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-93834 A use-after-free vulnerability was found in QEMU's 9pfs subsystem. |
high | 8.8 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-95520 A heap-based buffer overflow flaw was found in rpm. |
high | 7.1 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-4556 Exam4 is affected by a local privilege escalation vulnerability in the com.exteg... |
high | 7.8 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-82804 The scriptPath parameter is incorporated into a /bin/sh -c command without suffi... |
high | 8.8 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-69360 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-78545 The Okta Access Gateway does not sanitize the application label field before inc... |
high | 7.2 | — | Okta / access gateway | 2026-09-08 | 2026-09-29 |
| CVE-2026-97882 A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to... |
high | 7.3 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-87741 The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrust... |
high | 8.8 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-33639 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
high | 7.2 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-78550 The Okta Access Gateway management console passes user-supplied input to eval()... |
high | 7.2 | — | Okta / access gateway | 2026-09-08 | 2026-09-29 |
| CVE-2026-69359 Heap-based buffer overflow in Active Directory Domain Services allows an authori... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-69805 External control of file name or path in .NET allows an unauthorized attacker to... |
high | 8.1 | — | Microsoft / microsoft.diagnostics.runtime | 2026-09-08 | 2026-09-29 |
| CVE-2026-69854 Improper authentication in Spring Cloud Azure allows an unauthorized attacker to... |
high | 8.1 | — | Microsoft / spring cloud | 2026-09-08 | 2026-09-29 |
| CVE-2026-70351 Integer overflow or wraparound in Microsoft WebP Image Extension allows an unaut... |
high | 8.8 | — | Microsoft / webp image extension | 2026-09-08 | 2026-09-29 |
| CVE-2026-77504 Double free in Microsoft Office Word allows an unauthorized attacker to execute... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-77897 Relative path traversal in Power Automate allows an authorized attacker to eleva... |
high | 7.0 | — | Microsoft / power automate for desktop | 2026-09-08 | 2026-09-29 |
| CVE-2026-77908 Improper control of generation of code ('code injection') in Microsoft Dynamics... |
high | 8.8 | — | Microsoft / dynamics 365 | 2026-09-08 | 2026-09-29 |
| CVE-2026-69605 Use after free in Microsoft Install Service allows an authorized attacker to ele... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-29 |
| CVE-2026-89099 A race condition in the document value layer of MongoDB Server can allow concurr... |
high | 7.5 | — | Mongodb / mongodb | 2026-09-11 | 2026-09-29 |
| CVE-2026-85921 Double free in Windows Secure Kernel Mode allows an authorized attacker to eleva... |
high | 8.2 | — | Microsoft / windows 11 26h1 | 2026-09-14 | 2026-09-29 |
| CVE-2026-93393 A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C... |
high | 8.1 | — | Mongodb / c driver | 2026-09-17 | 2026-09-29 |
| CVE-2026-97060 X-SpringBoot through 6.0 lacks object-level authorization in user management end... |
high | 7.2 | — | — | 2026-09-25 | 2026-09-29 |
| CVE-2026-101091 SiYuan versions before v3.8.4 fail to properly validate SQL statements in block... |
high | 7.1 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-100692 Hugo is a static site generator. |
high | 7.5 | — | Gohugo / hugo | 2026-09-26 | 2026-09-29 |
| CVE-2026-77581 BentoPDF is a client-side PDF toolkit that is self hostable. |
high | 8.6 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-61825 code16 Sharp is a Laravel-based framework for building content-management and ad... |
high | 8.7 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-77265 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 7.5 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-77262 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 8.6 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-101280 A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. |
high | 7.3 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-101860 A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. |
high | 8.8 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102243 A vulnerability was identified in MODSetter SurfSense up to 2.0.3. |
high | 7.4 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102248 A vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5. |
high | 7.3 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102491 A vulnerability was identified in mahonelau kykms up to 8f130c2d85842d5b44caae78... |
high | 7.3 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-63419 OpenImageIO is a toolset for reading, writing, and manipulating image files of a... |
high | 7.8 | — | Openimageio / openimageio | 2026-09-18 | 2026-09-29 |
| CVE-2026-87748 Missing Authorization vulnerability in Interprobe Information Technologies Inc. |
high | 8.8 | — | — | 2026-09-29 | 2026-09-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.