September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-76722 Uncontrolled Format string vulnerabilities exist in the affected interface of HP... |
critical | 9.8 | — | — | 2026-09-29 | 2026-10-01 |
| CVE-2026-76723 Buffer overflow vulnerabilities exist in the affected interface of HPE Networkin... |
critical | 9.6 | — | — | 2026-09-29 | 2026-10-01 |
| CVE-2026-76724 A command injection vulnerability exists in CLI of the affected HPE Networking I... |
critical | 9.6 | — | — | 2026-09-29 | 2026-10-01 |
| CVE-2026-76725 A vulnerability has been identified in a management protocol of HPE Networking I... |
critical | 9.6 | — | — | 2026-09-29 | 2026-10-01 |
| CVE-2026-39117 An issue in AltumCode 66Uptime before v.54.0.0 and 66Uptime ping-servers plugin... |
critical | 9.8 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-53988 Dockhand before 1.0.40 contains an authentication bypass vulnerability in its gi... |
critical | 10.0 | — | — | 2026-09-29 | 2026-10-02 |
| CVE-2026-102331 Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.92 a... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102316 Use after free in Views in Google Chrome prior to 154.0.8037.92 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102304 Use after free in Passwords in Google Chrome prior to 154.0.8037.92 allowed a re... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102306 Use after free in Bluetooth in Google Chrome prior to 154.0.8037.92 allowed a re... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102308 Use after free in Views in Google Chrome prior to 154.0.8037.92 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102309 Use after free in FullScreen in Google Chrome prior to 154.0.8037.92 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-100291 In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, several ONVIF service endpoi... |
critical | 9.8 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2024-31026 An issue in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allow... |
critical | 9.8 | — | — | 2026-09-29 | 2026-10-27 |
| CVE-2026-102827 simple-git, an interface for running git commands in any node.js application, en... |
critical | 9.8 | — | Simple-git Project / simple-git | 2026-09-29 | 2026-10-08 |
| CVE-2026-102828 simple-git, an interface for running git commands in any node.js application, en... |
critical | 9.8 | — | Simple-git Project / simple-git | 2026-09-29 | 2026-10-08 |
| CVE-2026-95356 Use after free in WindowDialog in Google Chrome prior to 154.0.8037.57 allowed a... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95357 Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95347 Use after free in Updater in Google Chrome on on Mac prior to 154.0.8037.57 allo... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95349 Buffer overflow in WebGL in Google Chrome on on Android prior to 154.0.8037.57 a... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95350 Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 a... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95339 Use after free in ServiceWorker in Google Chrome prior to 154.0.8037.57 allowed... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95329 Out of bounds write in WebGL in Google Chrome on on Android prior to 154.0.8037.... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95331 Out of bounds write in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95318 Buffer overflow in Video in Google Chrome prior to 154.0.8037.57 allowed a remot... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95325 Use after free in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95310 Use after free in AdFilter in Google Chrome prior to 154.0.8037.57 allowed a rem... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95311 Free of non-heap memory in Fonts in Google Chrome prior to 154.0.8037.57 allowed... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95313 Use after free in Fullscreen in Google Chrome prior to 154.0.8037.57 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95299 Use after free in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote a... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95284 Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 a... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-95277 Use after free in Views in Google Chrome prior to 154.0.8037.57 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95281 Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 a... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95283 Buffer overflow in Tint in Google Chrome on on Android prior to 154.0.8037.57 al... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-84436 IBM Guardium Data Protection 12.2 is vulnerable to command injection in the cert... |
critical | 9.1 | — | Ibm / guardium data protection | 2026-09-29 | 2026-10-02 |
| CVE-2026-102560 A flaw was found in libsoup. |
critical | 9.8 | — | Gnome / libsoup | 2026-09-29 | 2026-10-22 |
| CVE-2026-102676 Electron is a framework for writing cross-platform desktop applications using Ja... |
critical | 9.8 | — | Electronjs / electron | 2026-09-29 | 2026-10-15 |
| CVE-2026-102425 Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injecti... |
critical | 10.0 | — | Balbooa / forms | 2026-09-29 | 2026-10-06 |
| CVE-2026-101127 Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in B... |
critical | 9.4 | — | Balbooa / forms | 2026-09-29 | 2026-10-06 |
| CVE-2026-100240 Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - Template... |
critical | 9.1 | — | — | 2026-09-29 | 2026-10-01 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.