September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,313
Critical
1,226
High
4,359
Medium
4,108
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-82348 Authorization Bypass Through User-Controlled Key in Apache Roller 6.1.5 allows a... |
high | 7.7 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-82376 Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 all... |
high | 7.7 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-82386 Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 all... |
high | 7.7 | — | — | 2026-09-28 | 2026-09-29 |
| CVE-2026-69380 Missing authorization in Microsoft Exchange Server allows an authorized attacker... |
high | 8.1 | — | Microsoft / exchange server | 2026-09-08 | 2026-09-29 |
| CVE-2026-69401 Use after free in Audio Video Control Transport Protocol allows an authorized at... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-29 |
| CVE-2026-69407 Integer overflow or wraparound in Volume Manager Driver allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-69418 Heap-based buffer overflow in Volume Manager Driver allows an authorized attacke... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-69432 Heap-based buffer overflow in Volume Manager Driver allows an authorized attacke... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-69438 Incorrect conversion between numeric types in Microsoft JScript allows an unauth... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-55159 luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for Ope... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-29 |
| CVE-2026-69806 Exposure of sensitive information to an unauthorized actor in .NET allows an aut... |
high | 7.0 | — | Microsoft / .net | 2026-09-08 | 2026-09-29 |
| CVE-2026-69439 Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized atta... |
high | 8.8 | — | Microsoft / .net | 2026-09-08 | 2026-09-29 |
| CVE-2026-77258 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 7.7 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-6935 IBM Concert 1.0.0 through 3.0.0 invokes operating system commands without fully... |
high | 7.8 | — | Ibm / concert | 2026-09-23 | 2026-09-29 |
| CVE-2026-69485 Use of uninitialized resource in Remote Desktop Client allows an authorized atta... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-77260 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 7.5 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-69516 Use after free in Connected Devices Platform Service (Cdpsvc) allows an authoriz... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-29 |
| CVE-2026-69530 Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unautho... |
high | 8.1 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-29 |
| CVE-2026-77255 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 8.6 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-69384 Null pointer dereference in Virtual Hard Disk (VHD) Miniport Driver allows an un... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-77259 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (C... |
high | 7.7 | — | Mcp-atlassian / mcp atlassian | 2026-09-22 | 2026-09-29 |
| CVE-2026-57223 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.0 | — | Oisf / suricata | 2026-09-18 | 2026-09-29 |
| CVE-2026-57227 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-18 | 2026-09-29 |
| CVE-2026-94622 vLLM versions through 0.29.0 contain a denial of service vulnerability in the NI... |
high | 7.5 | — | Vllm / vllm | 2026-09-21 | 2026-09-29 |
| CVE-2026-94623 vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL conne... |
high | 7.5 | — | Vllm / vllm | 2026-09-21 | 2026-09-29 |
| CVE-2026-94624 vLLM through 0.29.0 contains a denial of service vulnerability in P2P KV offload... |
high | 7.5 | — | Vllm / vllm | 2026-09-21 | 2026-09-29 |
| CVE-2026-94626 vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_param... |
high | 7.5 | — | Vllm / vllm | 2026-09-21 | 2026-09-29 |
| CVE-2026-94627 vLLM Mooncake connector through 0.29.0 fails to properly manage GPU KV cache blo... |
high | 7.5 | — | Vllm / vllm | 2026-09-21 | 2026-09-29 |
| CVE-2026-81473 Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper... |
high | 8.1 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-72668 Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent B... |
high | 7.3 | — | — | 2026-09-26 | 2026-09-29 |
| CVE-2026-96602 A flaw has been found in Abdurrab5 online-makeup-store. |
high | 7.3 | — | — | 2026-09-23 | 2026-09-29 |
| CVE-2026-97231 A vulnerability was found in volotat Anagnorisis up to 0.3.1/0.4.0. |
high | 7.3 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-94613 authentik is an open-source identity provider. |
high | 7.5 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-86065 Klever-Go is the Go implementation of the Klever blockchain protocol. |
high | 7.5 | — | — | 2026-09-23 | 2026-09-29 |
| CVE-2026-56737 phpMyFAQ is an open source FAQ web application. |
high | 8.1 | — | — | 2026-09-24 | 2026-09-29 |
| CVE-2026-95844 Moquette is a lightweight Java MQTT broker. |
high | 7.5 | — | Moquette / moquette | 2026-09-23 | 2026-09-29 |
| CVE-2026-86261 A weakness has been identified in sfturing hosp_order up to 627f426331da8086ce8f... |
high | 7.3 | — | — | 2026-09-07 | 2026-09-28 |
| CVE-2026-86262 A security vulnerability has been detected in sfturing hosp_order up to 627f4263... |
high | 7.3 | — | — | 2026-09-07 | 2026-09-28 |
| CVE-2026-86263 A vulnerability was detected in sfturing hosp_order up to 627f426331da8086ce8fff... |
high | 7.3 | — | — | 2026-09-07 | 2026-09-28 |
| CVE-2026-86313 Out-of-bounds write vulnerability in Samsung Opensource Walrus allows Overflow B... |
high | 7.8 | — | — | 2026-09-07 | 2026-09-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.