September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,364
Critical
1,230
High
4,374
Medium
4,126
Low
462
Severity not reported
1,172
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87626 Incorrect authorization in DeviceBoundSessionCredentials in Google Chrome prior... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-87600 Improper input validation in Safebrowsing in Google Chrome on on Android prior t... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-87475 Missing authorization in Omnibox in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87513 Missing authorization in ControlledFrame in Google Chrome prior to 153.0.8010.36... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87543 Missing authorization in Core in Google Chrome prior to 153.0.8010.36 allowed a... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87561 Incorrect authorization in Web Authentication in Google Chrome prior to 153.0.80... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87429 Missing authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 a... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87436 Incomplete cleanup in Browser in Google Chrome prior to 153.0.8010.36 allowed a... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87515 Incorrect authorization in FileAPI in Google Chrome prior to 153.0.8010.36 allow... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87503 Inappropriate implementation in Downloads in Google Chrome on on Android prior t... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87507 UI misrepresentation in Downloads in Google Chrome prior to 153.0.8010.36 allowe... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87501 UI misrepresentation in Passwords in Google Chrome prior to 153.0.8010.36 allowe... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87497 Uninitialized resource in Codecs in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87496 UI misrepresentation in Browser in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87441 Missing authorization in Downloads in Google Chrome prior to 153.0.8010.36 allow... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87445 UI misrepresentation in Session in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87446 Incomplete cleanup in Extensions in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87447 Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allow... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87556 Missing authorization in Browser in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87560 Missing authorization in Browser in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87645 Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.3... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87472 Improper input validation in FedCM in Google Chrome prior to 153.0.8010.36 allow... |
medium | 4.2 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87482 Cleartext transmission of sensitive data in HttpsUpgrades in Google Chrome on on... |
medium | 5.9 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87483 Incorrect authorization in Browser in Google Chrome on on Android prior to 153.0... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87484 UI misrepresentation in Geometry in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87486 Clickjacking in TrustedWebActivities in Google Chrome on on Android prior to 153... |
medium | 4.0 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87541 Information leak in Navigation in Google Chrome prior to 153.0.8010.36 allowed a... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87540 Incorrect authorization in Isolated in Google Chrome prior to 153.0.8010.36 allo... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87538 Clickjacking in Input in Google Chrome prior to 153.0.8010.36 allowed a remote a... |
medium | 4.2 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87535 Information loss or omission in Safebrowsing in Google Chrome on on Mac prior to... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87532 Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.3... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87557 Missing authorization in LocalNetworkAccess in Google Chrome prior to 153.0.8010... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87640 Out of bounds read in WebView in Google Chrome on on Android prior to 153.0.8010... |
medium | 6.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87649 UI misrepresentation in Downloads in Google Chrome prior to 153.0.8010.36 allowe... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87548 Improper state validation in Installer in Google Chrome prior to 153.0.8010.36 a... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87549 Incomplete cleanup in Downloads in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87552 Missing authorization in TrustedWebActivities in Google Chrome on on Android pri... |
medium | 5.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87641 Race condition in Browser in Google Chrome prior to 153.0.8010.36 allowed a remo... |
medium | 4.2 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87577 Incorrect authorization in Isolated in Google Chrome prior to 153.0.8010.36 allo... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87583 UI misrepresentation in Passwords in Google Chrome on on Android prior to 153.0.... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.