September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,364
Critical
1,230
High
4,374
Medium
4,126
Low
462
Severity not reported
1,172
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-58731 In multiple functions of physmem_extmem_linux.c, there is a possible out-of-boun... |
medium | 6.2 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58726 In FsmReleaseKey of fsm.c, there is a possible permission bypass due to a missin... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58718 In smmu_detach_dev_nested of arm-smmu-v3.c, there is a possible escalation of pr... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58721 In multiple locations, there is a possible information disclosure due to uniniti... |
medium | 4.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-91739 Missing authorization in Transactions Platform in Google Chrome prior to 153.0.8... |
medium | 4.2 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91740 Uninitialized resource in Skia in Google Chrome prior to 153.0.8010.47 allowed a... |
medium | 4.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91744 Race condition in PlatformIntegration in Google Chrome on on Mac prior to 153.0.... |
medium | 5.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91746 Integer overflow in Compositing in Google Chrome prior to 153.0.8010.47 allowed... |
medium | 4.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91726 Out of bounds read in WebGL in Google Chrome on on Android prior to 153.0.8010.4... |
medium | 4.7 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91725 Observable discrepancy in CSS in Google Chrome prior to 153.0.8010.47 allowed a... |
medium | 5.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91720 Uninitialized resource in ANGLE in Google Chrome prior to 153.0.8010.47 allowed... |
medium | 4.7 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91717 Missing authorization in Android in Google Chrome on on Android prior to 153.0.8... |
medium | 5.1 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91714 Observable discrepancy in Fonts in Google Chrome prior to 153.0.8010.47 allowed... |
medium | 5.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91713 Missing authorization in Browser in Google Chrome prior to 153.0.8010.47 allowed... |
medium | 4.2 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-87511 Missing authorization in DevTools in Google Chrome prior to 153.0.8010.36 allowe... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-15 |
| CVE-2026-87473 Incorrect authorization in FileHandling in Google Chrome prior to 153.0.8010.36... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-15 |
| CVE-2026-87469 Improper input validation in Extensions in Google Chrome prior to 153.0.8010.36... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-15 |
| CVE-2026-28584 In createSessionInternal of PackageInstallerService.java, there is a possible wa... |
medium | 5.5 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28596 In parseInterventionFromXml of GameManagerService.java, there is a possible perm... |
medium | 5.5 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28617 In add of WifiNetworkSuggestionsManager.java, there is a possible persistent DOS... |
medium | 5.5 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28627 In btm_sec_encrypt_change of btm_sec.cc, there is a possible downgrade attack du... |
medium | 4.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28633 In initForUserNoTracing of VoiceInteractionManagerService.java, there is a possi... |
medium | 5.5 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-87627 Interpretation conflict in Safebrowsing in Google Chrome on on Mac prior to 153.... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-14 |
| CVE-2026-49883 In checkReadPermission of PermissionsManager.java, there is a possible way to mo... |
medium | 5.5 | — | Google / android | 2026-09-08 | 2026-09-14 |
| CVE-2026-87575 Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowe... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-14 |
| CVE-2026-87656 Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.3... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-14 |
| CVE-2026-87546 Incorrect type conversion or cast in Safebrowsing in Google Chrome on on Mac pri... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-14 |
| CVE-2026-87551 Improper certificate validation in CORS in Google Chrome prior to 153.0.8010.36... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-14 |
| CVE-2026-87571 Improper certificate validation in Loader in Google Chrome prior to 153.0.8010.3... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-14 |
| CVE-2026-87468 Incorrect authorization in Isolated in Google Chrome prior to 153.0.8010.36 allo... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-87493 Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allo... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-87519 Incorrect authorization in Safebrowsing in Google Chrome prior to 153.0.8010.36... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-87522 Missing authorization in WebView in Google Chrome on on Android prior to 153.0.8... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-87584 Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-87580 Incorrect authorization in WebAppInstalls in Google Chrome prior to 153.0.8010.3... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-87589 Incorrect authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-87590 Improper input validation in Passwords in Google Chrome prior to 153.0.8010.36 a... |
medium | 5.9 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-87591 Incorrect authorization in Extensions in Google Chrome prior to 153.0.8010.36 al... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-87603 Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allo... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-87610 Incorrect authorization in Omnibox in Google Chrome prior to 153.0.8010.36 allow... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.