September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,313
Critical
1,226
High
4,359
Medium
4,108
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-63452 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-18 | 2026-09-28 |
| CVE-2026-71418 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-18 | 2026-09-28 |
| CVE-2026-71855 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-18 | 2026-09-28 |
| CVE-2026-93436 vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected... |
high | 7.5 | — | Vllm / vllm | 2026-09-17 | 2026-09-28 |
| CVE-2026-85887 Incorrect permission assignment for critical resource in M365 Copilot allows an... |
high | 7.7 | — | Microsoft / 365 copilot | 2026-09-18 | 2026-09-28 |
| CVE-2026-93592 vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the... |
high | 7.5 | — | Vllm / vllm | 2026-09-18 | 2026-09-28 |
| CVE-2026-63446 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-18 | 2026-09-28 |
| CVE-2026-63447 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-18 | 2026-09-28 |
| CVE-2026-63448 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-18 | 2026-09-28 |
| CVE-2026-46352 Suricata is a network Intrusion Detection System, Intrusion Prevention System an... |
high | 7.5 | — | Oisf / suricata | 2026-09-16 | 2026-09-28 |
| CVE-2026-77605 Notepad++ is a free and open-source source code editor. |
high | 7.8 | — | — | 2026-09-22 | 2026-09-28 |
| CVE-2026-86054 Notepad++ is a free and open-source source code editor. |
high | 7.8 | — | — | 2026-09-22 | 2026-09-28 |
| CVE-2026-86595 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
high | 8.8 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-57178 Python Social Auth is a social authentication/registration mechanism. |
high | 7.4 | — | — | 2026-09-24 | 2026-09-28 |
| CVE-2026-100707 Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall conte... |
high | 7.7 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100679 stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authent... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100703 Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its... |
high | 7.7 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100607 Flowise through 3.1.4 resolves SSO and local-password users solely by email with... |
high | 7.7 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100567 OpenClaw is an agent gateway distributed as the npm package 'openclaw'. |
high | 8.2 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100579 OpenClaw (npm package 'openclaw') before 2026.7.1 incorrectly trusts requester p... |
high | 7.6 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100587 OpenClaw versions before 2026.7.1 fail to properly validate owner authorization... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100558 OpenClaw versions before 2026.8.1 contain a resource exhaustion vulnerability in... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100530 OpenClaw versions before 2026.8.1 fail to bind working directory context to reus... |
high | 7.3 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-62744 Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unaut... |
high | 8.8 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-28 |
| CVE-2026-93990 Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is fo... |
high | 7.5 | — | — | 2026-09-19 | 2026-09-28 |
| CVE-2026-97335 Incorrect authorization in the custom storage volume creation endpoint in Canoni... |
high | 7.7 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-90925 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 7.1 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-90926 Improper Control of Generation of Code ('Code Injection') vulnerability in Innot... |
high | 8.8 | — | — | 2026-09-28 | 2026-09-28 |
| CVE-2026-100739 A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5d... |
high | 7.3 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100711 froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API k... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100660 Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.0.Final through 4.2.1... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100664 Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100672 The Comments plugin (getgrav/grav-plugin-comments) for Grav CMS through version... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100676 January, the media proxy/embed service of stoatchat (stoatchat/stoatchat), befor... |
high | 8.2 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100636 SiYuan versions before v3.8.4 contain a path traversal vulnerability in the expo... |
high | 7.6 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100599 OpenClaw versions 2026.5.1 through 2026.7.0 fail to apply the configured exec ap... |
high | 8.8 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100314 A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Pr... |
high | 7.3 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-84095 The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capa... |
high | 8.0 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-84096 The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capa... |
high | 8.0 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-85081 The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin b... |
high | 7.5 | — | — | 2026-09-26 | 2026-09-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.