September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,291
Critical
1,223
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87441 Missing authorization in Downloads in Google Chrome prior to 153.0.8010.36 allow... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87445 UI misrepresentation in Session in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87446 Incomplete cleanup in Extensions in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87447 Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allow... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87556 Missing authorization in Browser in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87560 Missing authorization in Browser in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87645 Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.3... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-85639 A security vulnerability has been detected in jofpin trape 2.0. |
medium | 5.6 | — | — | 2026-09-04 | 2026-09-10 |
| CVE-2026-71803 money-pos 1.0 contains a stored Cross-Site Scripting (XSS) vulnerability. |
medium | 5.4 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-75307 zhitan-ems 1.0.0 is vulnerable to Cross Site Scripting (XSS) via SVG file upload... |
medium | 6.1 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-69402 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 5.4 | — | Microsoft / sharepoint server | 2026-09-08 | 2026-09-10 |
| CVE-2026-62652 A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). |
medium | 5.3 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-62437 When guests are terminated, various pieces of cleanup need carrying out. |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-11891 Use After Free vulnerability in Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Ar... |
medium | 5.1 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-87472 Improper input validation in FedCM in Google Chrome prior to 153.0.8010.36 allow... |
medium | 4.2 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87482 Cleartext transmission of sensitive data in HttpsUpgrades in Google Chrome on on... |
medium | 5.9 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87483 Incorrect authorization in Browser in Google Chrome on on Android prior to 153.0... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87484 UI misrepresentation in Geometry in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87486 Clickjacking in TrustedWebActivities in Google Chrome on on Android prior to 153... |
medium | 4.0 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-73008 Exposure of private personal information to an unauthorized actor in Windows Bio... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-10 |
| CVE-2026-87541 Information leak in Navigation in Google Chrome prior to 153.0.8010.36 allowed a... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87540 Incorrect authorization in Isolated in Google Chrome prior to 153.0.8010.36 allo... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87538 Clickjacking in Input in Google Chrome prior to 153.0.8010.36 allowed a remote a... |
medium | 4.2 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87535 Information loss or omission in Safebrowsing in Google Chrome on on Mac prior to... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87532 Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.3... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-88270 GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mo... |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-88790 A security vulnerability has been detected in proma-ai Proma up to 0.19.37. |
medium | 4.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-87924 A security vulnerability has been detected in Rizwan17 inventory-management-syst... |
medium | 6.5 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-86675 A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. |
medium | 6.3 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-84282 A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownC... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-85484 HTML::FormHandler versions before 0.410002 for Perl render option group labels a... |
medium | 6.1 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-85485 HTML::FormHandler versions before 0.410002 for Perl render some error messages i... |
medium | 6.1 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-85630 HTML::FormHandler versions before 0.410002 for Perl render field attributes into... |
medium | 6.1 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-81782 Subscriber Cross Site Scripting (XSS) in WP Docs <= 2.3.1 versions. |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-81787 Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 version... |
medium | 6.5 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-4657 The Easy Google Fonts plugin for WordPress is vulnerable to Stored Cross-Site Sc... |
medium | 6.4 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-19872 HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting v... |
medium | 6.1 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-15796 The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-... |
medium | 6.4 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-15460 The Bluetooth Classic (BR/EDR) L2CAP receive handler bt_l2cap_br_recv() in subsy... |
medium | 5.4 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-12285 Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valha... |
medium | 4.0 | — | — | 2026-09-08 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.