September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100569 OpenClaw is an npm-distributed application. |
medium | 5.5 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100571 OpenClaw (npm package 'openclaw') versions >= 2026.6.6 and < 2026.8.1 apply the... |
medium | 5.3 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100572 OpenClaw versions >= 2026.3.25 and < 2026.8.1 apply invalid-token rate limiting... |
medium | 5.3 | — | — | 2026-09-26 | 2026-10-05 |
| CVE-2026-100574 OpenClaw (npm package 'openclaw') before 2026.8.1 contains a server-side request... |
medium | 5.9 | — | — | 2026-09-26 | 2026-09-29 |
| CVE-2026-100562 OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability... |
medium | 5.4 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100563 OpenClaw (npm package `openclaw`) before 2026.8.1 does not neutralize leading ch... |
medium | 5.4 | — | — | 2026-09-26 | 2026-10-05 |
| CVE-2026-100564 OpenClaw versions before 2026.8.1 fail to neutralize spreadsheet formula charact... |
medium | 5.4 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100566 OpenClaw LINE versions before 2026.8.1 contain an access control vulnerability w... |
medium | 6.5 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100556 OpenClaw (npm package openclaw) versions >= 2026.5.2 and < 2026.8.1 contain an i... |
medium | 6.3 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100548 OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 contain a... |
medium | 5.3 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100549 OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in QQBo... |
medium | 5.4 | — | — | 2026-09-26 | 2026-09-29 |
| CVE-2026-100550 OpenClaw (npm package 'openclaw') before 2026.8.1 contains an access-control byp... |
medium | 5.4 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100553 OpenClaw versions >= 2026.6.9 and < 2026.8.1 do not declare the native chatId pa... |
medium | 4.3 | — | — | 2026-09-26 | 2026-09-29 |
| CVE-2026-100554 OpenClaw (npm package 'openclaw') versions >= 2026.5.12 and < 2026.8.1 do not im... |
medium | 4.2 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100545 OpenClaw (npm package `openclaw`) before 2026.8.1 incorrectly enforces sender to... |
medium | 5.3 | — | — | 2026-09-26 | 2026-09-29 |
| CVE-2026-100546 OpenClaw (npm package `openclaw`) versions >= 2026.7.2 and < 2026.9.2 contain a... |
medium | 6.4 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100547 OpenClaw is a coding agent distributed as the npm package `openclaw`. |
medium | 5.5 | — | — | 2026-09-26 | 2026-10-05 |
| CVE-2026-100536 OpenClaw versions before 2026.8.1 fail to validate all source fields in structur... |
medium | 6.5 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100538 OpenClaw (npm package 'openclaw') before 2026.8.1 does not apply the originating... |
medium | 6.5 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100540 OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default a... |
medium | 6.8 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100528 OpenClaw (npm package 'openclaw') before 2026.8.1 could send third-party provide... |
medium | 5.4 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100529 OpenClaw versions before 2026.8.1 contain an authorization scope widening vulner... |
medium | 6.4 | — | — | 2026-09-26 | 2026-09-29 |
| CVE-2026-100531 The @openclaw/slack npm package before 2026.8.1 contains an authorization flaw i... |
medium | 6.5 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100533 OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in the... |
medium | 5.3 | — | — | 2026-09-26 | 2026-09-29 |
| CVE-2026-100525 The OpenClaw Prometheus diagnostics plugin (@openclaw/diagnostics-prometheus) be... |
medium | 4.3 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100526 OpenClaw's Discord integration (npm package @openclaw/discord) before version 20... |
medium | 5.3 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100527 OpenClaw before 2026.8.2 contains a denial of service vulnerability in the Brows... |
medium | 5.3 | — | — | 2026-09-26 | 2026-10-05 |
| CVE-2026-100524 Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the... |
medium | 5.4 | — | — | 2026-09-26 | 2026-09-30 |
| CVE-2026-100505 Ghidra versions 9.2 through 12.1.4 contain a heap out-of-bounds read vulnerabili... |
medium | 4.4 | — | Nsa / ghidra | 2026-09-26 | 2026-10-08 |
| CVE-2026-100521 Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in... |
medium | 6.1 | — | — | 2026-09-26 | 2026-09-29 |
| CVE-2026-100522 Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in... |
medium | 6.1 | — | — | 2026-09-26 | 2026-09-28 |
| CVE-2026-100523 Cotonti through 1.0.0 contains an open redirect vulnerability in message.php tha... |
medium | 6.1 | — | — | 2026-09-26 | 2026-10-05 |
| CVE-2026-100503 Ghidra versions through 12.1.4 contain a heap use-after-free vulnerability in th... |
medium | 5.5 | — | Nsa / ghidra | 2026-09-26 | 2026-10-08 |
| CVE-2026-91768 The IPv6 branch of the FastCGI client access check compares only the first 12 by... |
medium | 6.5 | — | Php / php | 2026-09-25 | 2026-10-27 |
| CVE-2026-92842 The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-pr... |
medium | 5.9 | — | Php / php | 2026-09-25 | 2026-10-27 |
| CVE-2026-63431 Horilla is an HR and CRM software. |
medium | 6.5 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-63432 Horilla is an HR and CRM software. |
medium | 6.5 | — | — | 2026-09-25 | 2026-09-28 |
| CVE-2026-100418 Flame through 2.4.0 contains an information exposure vulnerability in the unauth... |
medium | 5.3 | — | — | 2026-09-25 | 2026-09-30 |
| CVE-2026-100501 Flame through 2.4.0 contains an improper restriction of excessive authentication... |
medium | 6.5 | — | — | 2026-09-25 | 2026-10-05 |
| CVE-2026-100502 Flame through 2.4.0 contains an insufficient session expiration vulnerability in... |
medium | 5.0 | — | — | 2026-09-25 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.