September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,364
Critical
1,230
High
4,374
Medium
4,126
Low
462
Severity not reported
1,172
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-102304 Use after free in Passwords in Google Chrome prior to 154.0.8037.92 allowed a re... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95310 Use after free in AdFilter in Google Chrome prior to 154.0.8037.57 allowed a rem... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95311 Free of non-heap memory in Fonts in Google Chrome prior to 154.0.8037.57 allowed... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95281 Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 a... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95299 Use after free in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote a... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95277 Use after free in Views in Google Chrome prior to 154.0.8037.57 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102306 Use after free in Bluetooth in Google Chrome prior to 154.0.8037.92 allowed a re... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95313 Use after free in Fullscreen in Google Chrome prior to 154.0.8037.57 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95318 Buffer overflow in Video in Google Chrome prior to 154.0.8037.57 allowed a remot... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95325 Use after free in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95331 Out of bounds write in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95339 Use after free in ServiceWorker in Google Chrome prior to 154.0.8037.57 allowed... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95347 Use after free in Updater in Google Chrome on on Mac prior to 154.0.8037.57 allo... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95356 Use after free in WindowDialog in Google Chrome prior to 154.0.8037.57 allowed a... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102308 Use after free in Views in Google Chrome prior to 154.0.8037.92 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102309 Use after free in FullScreen in Google Chrome prior to 154.0.8037.92 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102316 Use after free in Views in Google Chrome prior to 154.0.8037.92 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95283 Buffer overflow in Tint in Google Chrome on on Android prior to 154.0.8037.57 al... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95329 Out of bounds write in WebGL in Google Chrome on on Android prior to 154.0.8037.... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95350 Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 a... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95357 Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95349 Buffer overflow in WebGL in Google Chrome on on Android prior to 154.0.8037.57 a... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102331 Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.92 a... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-58822 In multiple functions of ftsmooth.c, there is a possible memory safety issue due... |
critical | 9.8 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-49921 In multiple locations, there is a possible memory safety issue due to a heap buf... |
critical | 9.8 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-91749 Use after free in Workers in Google Chrome prior to 153.0.8010.47 allowed a remo... |
critical | 9.6 | — | Google / chrome | 2026-09-15 | 2026-09-24 |
| CVE-2026-55366 In IP Multimedia Subsystem, there is a possible authentication bypass due to a l... |
critical | 9.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56960 In multiple locations, there is a possible use-after-free due to a logic error i... |
critical | 9.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-93374 Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.52 all... |
critical | 9.6 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-93373 Use after free in Extensions in Google Chrome prior to 153.0.8010.52 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-93372 Buffer overflow in WebGL in Google Chrome on on Android prior to 153.0.8010.52 a... |
critical | 9.6 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-87544 Incorrect authorization in Extensions in Google Chrome prior to 153.0.8010.36 al... |
critical | 9.8 | — | Google / chrome | 2026-09-09 | 2026-09-18 |
| CVE-2026-91738 Improper input validation in ANGLE in Google Chrome prior to 153.0.8010.47 allow... |
critical | 9.6 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91729 Use after free in DigitalCredentials in Google Chrome prior to 153.0.8010.47 all... |
critical | 9.6 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91728 Integer overflow in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91718 Use after free in Core in Google Chrome prior to 153.0.8010.47 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91716 Use after free in Auth in Google Chrome prior to 153.0.8010.47 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91710 Use after free in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed... |
critical | 9.6 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-28606 In handleBondStateChanged of AdapterService.java, there is a possible way to ski... |
critical | 9.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-87595 Server-side request forgery in Mobile in Google Chrome prior to 153.0.8010.36 al... |
critical | 9.8 | — | Google / chrome | 2026-09-09 | 2026-09-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.