September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,290
Critical
1,223
High
4,344
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86722 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an authe... |
high | 8.1 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-86727 AVideo through 29.0 contains an information disclosure vulnerability in plugin/L... |
high | 7.5 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-86732 Craft CMS versions before 5.10.12 contain a remote code execution vulnerability... |
high | 8.8 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-76202 Adobe Commerce is affected by an Incorrect Authorization vulnerability that coul... |
high | 8.2 | — | Adobe / commerce | 2026-09-08 | 2026-09-10 |
| CVE-2026-61517 Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection... |
high | 7.2 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-81988 Acrobat Reader is affected by a Use After Free vulnerability that could result i... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-81989 Acrobat Reader is affected by a Use After Free vulnerability that could result i... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-81990 Acrobat Reader is affected by a Use After Free vulnerability that could result i... |
high | 7.8 | — | Adobe / acrobat | 2026-09-08 | 2026-09-10 |
| CVE-2026-87644 Incorrect authorization in Views in Google Chrome on on Windows prior to 153.0.8... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87648 Use after free in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 al... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87633 Use after free in Views in Google Chrome prior to 153.0.8010.36 allowed a local... |
high | 8.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87636 Type confusion in XML in Google Chrome prior to 153.0.8010.36 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87639 Use after free in WebPackaging in Google Chrome prior to 153.0.8010.36 allowed a... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87617 Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87618 Incorrect reference resolution in Storage in Google Chrome on on Windows prior t... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87625 Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87628 Use after free in Cast in Google Chrome prior to 153.0.8010.36 allowed an adjace... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87604 Out of bounds read in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a re... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87612 Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87616 Improper initialization in Views in Google Chrome on on Windows prior to 153.0.8... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87582 Confused deputy in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87585 Double free in PDFium in Google Chrome on on Windows prior to 153.0.8010.36 allo... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87587 Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87588 Use after free in Chromecast in Google Chrome prior to 153.0.8010.36 allowed a r... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87601 Race condition in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote at... |
high | 7.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87554 Race condition in Chromoting in Google Chrome on on Windows prior to 153.0.8010.... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87572 Injection in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote a... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87578 Use after free in Receiver in Google Chrome prior to 153.0.8010.36 allowed an ad... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87579 Buffer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remo... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87542 Use after free in Input in Google Chrome prior to 153.0.8010.36 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87553 Improper input validation in SiteIsolation in Google Chrome prior to 153.0.8010.... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87530 Uncontrolled search path element in CredentialProvider in Google Chrome on on Wi... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87514 Use after free in Views in Google Chrome prior to 153.0.8010.36 allowed a local... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87524 Use after free in Core in Google Chrome on on Windows prior to 153.0.8010.36 all... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87506 Privilege elevation in WebUI in Google Chrome prior to 153.0.8010.36 allowed a r... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87509 Incorrect authorization in Updater in Google Chrome on on Windows prior to 153.0... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87510 Improper input validation in FileAPI in Google Chrome prior to 153.0.8010.36 all... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87481 Incorrect authorization in WebView in Google Chrome on on Android prior to 153.0... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87487 Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allo... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87489 Memory corruption in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.