September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,364
Critical
1,230
High
4,374
Medium
4,126
Low
462
Severity not reported
1,172
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-102315 Uninitialized resource in Media in Google Chrome on on Windows prior to 154.0.80... |
low | 3.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102319 Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.92 allowed a... |
low | 3.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95359 Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037... |
low | 3.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102311 Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037... |
low | 3.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-55290 In setTo of ResourceTypes.cpp, there is a possible out-of-bounds heap read due t... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-49895 In get_eht_operation_channel_width of ieee802_11_common.c, there is a possible o... |
low | 3.5 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-45519 In screenArgsForPermissionCheckIfAny of multiple locations there is a possible r... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-45521 In openFile of AppFuseBridge.java, there is a possible information disclosure du... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-45525 In multiple locations, there is a possible improper data sanitization due to a l... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-28671 In updateInternal of MediaProvider.java, there is a possible expose contents of... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-23 |
| CVE-2026-93378 Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed... |
low | 3.1 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-93380 Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a r... |
low | 3.1 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-93384 Server-side request forgery in Omnibox in Google Chrome on on Android prior to 1... |
low | 3.7 | — | Google / chrome | 2026-09-17 | 2026-09-18 |
| CVE-2026-91723 Race condition in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed... |
low | 3.1 | — | Google / chrome | 2026-09-15 | 2026-09-18 |
| CVE-2026-91747 Use after free in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote... |
low | 3.1 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91730 Incomplete cleanup in GetUserMedia in Google Chrome prior to 153.0.8010.47 allow... |
low | 3.1 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91708 Race condition in Network in Google Chrome prior to 153.0.8010.47 allowed a remo... |
low | 3.1 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-28582 In onCreate of ConfirmDeviceCredentialActivity.java, there is a possible unautho... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-0054 In isCallerAllowed of WalletContextualLocationsService.kt, there is a possible w... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28630 In onCreate of ContactsPickerActivity.kt, there is a possible misleading UI due... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28623 In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28622 In getQueryBuilderInternal of MediaProvider.java, there is a possible way to ret... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28660 In getAllSessions of multiple files, there is a possible confused deputy due to... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28652 In multiple functions of RangingServiceImpl.java, there is a possible MITM due t... |
low | 3.1 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28638 In multiple functions of XmpDataParser.java, there is a possible improper data s... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-87525 Out of bounds read in Chromoting in Google Chrome on on Windows prior to 153.0.8... |
low | 2.7 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87442 Confused deputy in Prerender in Google Chrome prior to 153.0.8010.36 allowed a r... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87539 Observable discrepancy in Network in Google Chrome prior to 153.0.8010.36 allowe... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87456 Uninitialized resource in Media in Google Chrome prior to 153.0.8010.36 allowed... |
low | 3.4 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87434 Missing authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87647 Uninitialized resource in GPU in Google Chrome prior to 153.0.8010.36 allowed a... |
low | 3.4 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87576 Uninitialized resource in GPU in Google Chrome on on Android prior to 153.0.8010... |
low | 3.4 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87657 Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote at... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87614 Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87485 Incorrect authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87498 Missing authorization in WebUI in Google Chrome prior to 153.0.8010.36 allowed a... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87517 Race condition in Mobile in Google Chrome on on iOS prior to 153.0.8010.36 allow... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87531 Information leak in CORS in Google Chrome prior to 153.0.8010.36 allowed a remot... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87652 Incorrect authorization in PushAPI in Google Chrome prior to 153.0.8010.36 allow... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87521 Information leak in WebMCP in Google Chrome prior to 153.0.8010.36 allowed a rem... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.