September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,291
Critical
1,223
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-68838 Stack-based buffer overflow in Windows NTFS allows an authorized attacker to ele... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-68827 Integer underflow (wrap or wraparound) in Windows GDI+ allows an authorized atta... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-62694 Use after free in Windows Installer allows an authorized attacker to elevate pri... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-62706 Out-of-bounds read in Microsoft Windows Media Foundation allows an unauthorized... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-62759 Authentication bypass by spoofing in Windows Netlogon allows an unauthorized att... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-62369 KubeEdge is an open source system for extending native containerized application... |
high | 8.1 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-61629 nginx ignition is a user interface for the nginx web server. |
high | 7.5 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-62182 KubeEdge is an open source system for extending native containerized application... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-58269 Sync-in Server is an open-source platform for file storage, sharing, collaborati... |
high | 8.1 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-55105 Joplin is an open source note-taking and to-do application that organises notes... |
high | 7.7 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-50349 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-63671 MDC is a tool to take regular Markdown and write documents interacting deeply wi... |
high | 8.1 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-63325 Redocly CLI makes OpenAPI validation, linting, and documentation workflows easie... |
high | 7.8 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-45720 Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. |
high | 7.0 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-45726 Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. |
high | 7.6 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-50285 Pomerium is an identity and context-aware access proxy. |
high | 7.5 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54692 SAIL is a cross-platform library for loading and saving images with support for... |
high | 7.8 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54716 Valhalla is an open source routing engine and accompanying libraries for use wit... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54339 Glean is a self-hosted RSS reader and personal knowledge management tool. |
high | 7.7 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54597 ITFlow provides an IT documentation, ticketing and accounting system for small m... |
high | 8.3 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54916 NetBox Device Type Library is a collection of community-sourced device type defi... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-68523 `fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that process... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-68537 `fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that process... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-77615 Paella Player is a set of libraries to create a multi stream video player. |
high | 8.7 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-50158 yutu is an AI-powered toolkit for managing and growing YouTube channels. |
high | 7.7 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54519 AI Agent Automation is a modular AI agent workflow automation platform with sche... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54520 AI Agent Automation is a modular AI agent workflow automation platform with sche... |
high | 8.1 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54634 Hamlib is a ham radio control library for radios, rotators, and amplifiers. |
high | 7.3 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54148 http4k is a functional toolkit for Kotlin HTTP applications. |
high | 8.1 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-58197 ToolHive is a utility designed to simplify the deployment and management of Mode... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-61672 Capsule is a multi-tenancy and policy-based framework for Kubernetes. |
high | 7.1 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-32641 Parseable is a log analytics platform built for high-volume data ingestion and a... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-33625 LMDeploy is a toolkit for compressing, deploying, and serving large language mod... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-62278 LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel... |
high | 8.1 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-85058 Moquette is a lightweight Java MQTT broker. |
high | 7.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-91127 File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other... |
high | 8.2 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-68928 Acode is a powerful text and code editor for Android. |
high | 8.6 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-61687 Hatchet is a platform for orchestrating background tasks, AI agents, and durable... |
high | 7.1 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-63116 deepstream is a server that allows clients and backend services to sync data, se... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-77560 Tinyauth is an authentication and authorization server. |
high | 8.1 | — | — | 2026-09-21 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.