September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,291
Critical
1,223
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-59814 Joplin is an open source note-taking and to-do application that organises notes... |
high | 7.6 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-61820 pg_partman is a PostgreSQL extension that manages partitioned tables by time or... |
high | 8.5 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-83598 Netdata is an open source observability tool. |
high | 7.8 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-83599 Netdata is an open source observability tool. |
high | 7.5 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-83603 Netdata is an open source observability tool. |
high | 8.4 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-83597 Netdata is an open source observability tool. |
high | 7.0 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-85279 Notepad++ is a free and open-source source code editor. |
high | 8.6 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-85995 Notepad++ is a free and open-source source code editor. |
high | 7.3 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-10853 IBM MQ could allow an authenticated attacker with cluster access to cause a deni... |
high | 8.8 | — | Ibm / mq | 2026-09-18 | 2026-09-23 |
| CVE-2026-48826 HomeBox is a home inventory and organization system. |
high | 8.1 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-48975 HomeBox is a home inventory and organization system. |
high | 8.1 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-48976 HomeBox is a home inventory and organization system. |
high | 8.1 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-61628 nginx ignition is a user interface for the nginx web server. |
high | 8.1 | — | — | 2026-09-21 | 2026-09-23 |
| CVE-2026-11375 IBM MQ could allow an authenticated attacker to cause a denial of service or pot... |
high | 8.8 | — | Ibm / mq | 2026-09-18 | 2026-09-23 |
| CVE-2026-11378 IBM MQ could allow an authenticated attacker to cause a denial of service or pot... |
high | 8.8 | — | Ibm / mq | 2026-09-18 | 2026-09-23 |
| CVE-2026-45048 Open Access Management (OpenAM) is an access management solution. |
high | 8.5 | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-15358 ZohoCorp ManageEngine OpManager and Network Configuration Manager versions befor... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-84789 ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and belo... |
high | 7.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-84791 ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and belo... |
high | 7.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-76979 ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and belo... |
high | 7.7 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-76980 ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and belo... |
high | 7.4 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-86679 ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulner... |
high | 7.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-86681 ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulner... |
high | 7.6 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-96775 MLflow's dspy flavor, versions >= 2.0, applies the MLFLOW_ALLOW_PICKLE_DESERIALI... |
high | 8.8 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-95927 A vulnerability was identified in SourceCodester Online Reviewer Management Syst... |
high | 7.3 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-80047 A vulnerability in Hugging Face Transformers (versions 4.57.0 to 5.16.1) allows... |
high | 7.8 | — | — | 2026-09-01 | 2026-09-23 |
| CVE-2022-4997 The jet-form-builder-stripe-gateway WordPress plugin before 1.1.0 does not sanit... |
high | 8.6 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-14321 The divi-dash WordPress plugin before 1.0.7 does not validate the source of the... |
high | 8.2 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-86608 The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisati... |
high | 8.2 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-93508 The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict... |
high | 8.1 | — | — | 2026-09-23 | 2026-09-23 |
| CVE-2026-50275 The Datadog PHP Tracer provides application performance monitoring and distribut... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-23 |
| CVE-2026-77239 WACRM is a self-hostable CRM template for WhatsApp. |
high | 8.1 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-61721 FluidSynth is a software synthesizer based on the SoundFont 2 specifications. |
high | 8.0 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-61819 pg_partman is a PostgreSQL extension that manages partitioned tables by time or... |
high | 8.5 | — | — | 2026-09-18 | 2026-09-23 |
| CVE-2026-94462 Spree is an open source e-commerce solution built with Ruby on Rails. |
high | 7.1 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-58268 SIPGO is a library for writing SIP services in the GO language. |
high | 7.5 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-59991 psd-tools is a Python package for working with Adobe Photoshop PSD files. |
high | 7.5 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-77322 SIPGO is a library for writing SIP services in the GO language. |
high | 7.5 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-61685 ReactPress is a publishing system for React developers. |
high | 7.5 | — | — | 2026-09-22 | 2026-09-23 |
| CVE-2026-31377 An Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta... |
high | 7.5 | — | — | 2026-09-23 | 2026-09-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.