September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,291
Critical
1,223
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-55897 luci-app-advanced-reboot is a LuCI (web interface) application for OpenWrt that... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-88419 An unrestricted upload of files with a dangerous type in the thumbnail-upload en... |
high | 8.8 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-82566 The Botslab G980H dash camera firmware contains a session management vulnerabili... |
high | 8.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-84399 The Botslab G980H dash camera firmware contains an authorization vulnerability i... |
high | 8.8 | — | — | 2026-09-24 | 2026-09-24 |
| CVE-2026-86003 CoreDNS is a DNS server written in Go. |
high | 7.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-54239 Faust.js is a headless WordPress toolkit. |
high | 8.8 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-85077 Sanic is an opensource python web server/framework. |
high | 8.2 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-81515 Steeltoe is an open source project that provides a collection of libraries that... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-61548 Rsyslog is a rocket-fast system for log processing. |
high | 8.1 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-61817 pg_partman is a PostgreSQL extension that manages partitioned tables by time or... |
high | 8.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-61818 pg_partman is a PostgreSQL extension that manages partitioned tables by time or... |
high | 8.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-61821 pg_partman is a PostgreSQL extension that manages partitioned tables by time or... |
high | 8.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-86039 libp2p is a JavaScript implementation of the libp2p networking stack. |
high | 8.2 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-86040 libp2p is a JavaScript implementation of the libp2p networking stack. |
high | 7.5 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-54354 MapServer is a system for developing web-based GIS applications. |
high | 8.2 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-86049 Jupyter Server is the backend for Jupyter web applications. |
high | 7.1 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-62371 KubeEdge is an open source system for extending native containerized application... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-88407 An out-of-bounds read in the node_token_count/relation_token_count component of... |
high | 7.5 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-61551 Icinga 2 is an open source monitoring system. |
high | 8.6 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-61552 Icinga 2 is an open source monitoring system. |
high | 7.2 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-55071 MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safe... |
high | 8.4 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-54647 CubeCart is an ecommerce software solution. |
high | 7.2 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-82399 CoreDNS is a DNS server written in Go. |
high | 7.5 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-85719 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-50277 dd-trace-cpp is the Datadog distributed tracing library for C++. |
high | 7.5 | — | — | 2026-09-17 | 2026-09-24 |
| CVE-2026-77301 adm-zip is a JavaScript library for creating and extracting ZIP archives in Node... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-69184 c-ares is an asynchronous resolver library. |
high | 7.5 | — | — | 2026-09-18 | 2026-09-24 |
| CVE-2026-55567 BleachBit cleans files to free disk space and to maintain privacy. |
high | 7.8 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-53940 Conda is a system-level binary package and environment manager that runs on majo... |
high | 8.8 | — | — | 2026-09-21 | 2026-09-24 |
| CVE-2026-88344 An out-of-bounds read vulnerability exists in the schema lexer of flatcc 4c3b999... |
high | 7.5 | — | — | 2026-09-22 | 2026-09-24 |
| CVE-2026-85178 Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/va... |
high | 7.7 | — | — | 2026-09-03 | 2026-09-24 |
| CVE-2026-86119 Webstudio through 0.296.0 contains an unauthenticated server-side request forger... |
high | 8.6 | — | — | 2026-09-05 | 2026-09-24 |
| CVE-2026-89266 stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where... |
high | 8.2 | — | — | 2026-09-12 | 2026-09-24 |
| CVE-2026-91144 ZFile through 5.0.5 fails to validate requested file paths against a share link'... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-24 |
| CVE-2026-91923 KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in... |
high | 7.7 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-91989 atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in the... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-92000 adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output li... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-92602 TDuck survey form through version 5.3 fails to validate webhook URLs or verify f... |
high | 7.1 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-47094 SIMAC MyPHR 1.1 contains an insecure direct object reference (IDOR) vulnerabilit... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-24 |
| CVE-2026-92762 Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions onl... |
high | 8.8 | — | — | 2026-09-16 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.