September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,313
Critical
1,226
High
4,359
Medium
4,108
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86268 A vulnerability was detected in itsourcecode School Management System 1.0. |
high | 7.3 | — | — | 2026-09-07 | 2026-09-28 |
| CVE-2026-76562 The Sidebar Manager Light plugin for WordPress is vulnerable to Stored Cross-Sit... |
high | 7.2 | — | — | 2026-09-10 | 2026-09-28 |
| CVE-2026-84375 js-yaml is a JavaScript YAML parser and dumper. |
high | 7.5 | — | — | 2026-09-01 | 2026-09-28 |
| CVE-2026-100848 AzuraCast (Composer package azuracast/azuracast) before 0.23.8 validates a stati... |
high | 7.1 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100849 AzuraCast is a self-hosted web radio management suite. |
high | 7.1 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100852 AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquid... |
high | 8.8 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-101064 Obot before v0.23.0 contains a server-side request forgery vulnerability in remo... |
high | 7.6 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100614 Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the met... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100615 Cap-go capgo.app before 12.267.1 fails to validate target API key privilege duri... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100622 capgo.app through 12.129.0 fails to verify deletion status when serving cached b... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100864 heym before 0.0.91 contains a sandbox escape vulnerability in the expression eng... |
high | 8.8 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100865 Heym before 0.0.53 evaluates workflow condition expressions using Python's eval(... |
high | 8.8 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-100872 Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during... |
high | 7.5 | — | — | 2026-09-27 | 2026-09-28 |
| CVE-2026-6794 IBM Concert 1.0.0 through 3.0.0 has a double free vulnerability that exists due... |
high | 7.8 | — | Ibm / concert | 2026-09-23 | 2026-09-28 |
| CVE-2026-6730 IBM Concert 1.0.0 through 3.0.0 is vulnerable to a buffer overflow, caused by im... |
high | 7.8 | — | Ibm / concert | 2026-09-23 | 2026-09-28 |
| CVE-2026-70583 Heap-based buffer overflow in Windows Core Messaging allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-85740 LightRAG provides simple and fast retrieval-augmented generation. |
high | 7.1 | — | — | 2026-09-22 | 2026-09-28 |
| CVE-2026-56681 9Router is an AI router & token saver. |
high | 7.3 | — | — | 2026-09-22 | 2026-09-28 |
| CVE-2026-75608 Frigate is an open source network video recorder. |
high | 7.7 | — | — | 2026-09-22 | 2026-09-28 |
| CVE-2026-100578 OpenClaw (npm package `openclaw`) before 2026.7.1 fails to restrict owner-only i... |
high | 7.6 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100586 OpenClaw Codex before 2026.7.1 fails to properly enforce owner authorization whe... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100598 OpenClaw (npm package openclaw) before 2026.7.1 incorrectly binds Signal approva... |
high | 7.1 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-77505 Use after free in DNS Server allows an unauthorized attacker to execute code ove... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-77896 Integer overflow or wraparound in Remote Desktop Client allows an unauthorized a... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-13210 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7... |
high | 7.7 | — | Gitlab / gitlab | 2026-09-15 | 2026-09-28 |
| CVE-2026-19304 IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacke... |
high | 7.7 | — | Langflow / langflow | 2026-09-04 | 2026-09-28 |
| CVE-2026-100663 Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.1... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100671 Grav is a flat-file CMS. |
high | 8.0 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100639 SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gu... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100643 SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View... |
high | 8.0 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100606 Flowise through 3.1.4 (Enterprise/platform mode with SSO enabled) contains an au... |
high | 7.7 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100610 Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/u... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-69499 Integer overflow or wraparound in Windows Imaging Component allows an unauthoriz... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-28 |
| CVE-2026-69498 Use after free in Windows Win32K allows an authorized attacker to elevate privil... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-28 |
| CVE-2026-88765 GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to... |
high | 8.5 | — | Gitlab / gitlab | 2026-09-15 | 2026-09-28 |
| CVE-2026-92470 GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 bef... |
high | 7.7 | — | Gitlab / gitlab | 2026-09-24 | 2026-09-28 |
| CVE-2026-45751 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-10 | 2026-09-28 |
| CVE-2026-45762 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-10 | 2026-09-28 |
| CVE-2026-46387 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-10 | 2026-09-28 |
| CVE-2026-45747 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-10 | 2026-09-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.