September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,291
Critical
1,223
High
4,345
Medium
4,103
Low
460
Severity not reported
1,160
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-71429 stream-json is a micro-library of stream components for processing JSON and JSON... |
medium | 6.2 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-53760 Admidio is an open-source user management solution. |
medium | 5.2 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-49830 DSpace open source software is a repository application which provides durable a... |
medium | 4.4 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-49831 DSpace open source software is a repository application which provides durable a... |
medium | 5.5 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-49833 DSpace open source software is a repository application which provides durable a... |
medium | 5.5 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-84377 LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) fo... |
medium | 6.5 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-84378 HTTPX2 is a next generation HTTP client for Python. |
medium | 5.9 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-84379 HTTPX2 is a next generation HTTP client for Python. |
medium | 5.3 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-84380 HTTPX2 is a next generation HTTP client for Python. |
medium | 5.6 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-52832 Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. |
medium | 4.9 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-53636 Open edX Platform enables the authoring and delivery of online learning at any s... |
medium | 4.7 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-55421 Open edX Platform enables the authoring and delivery of online learning at any s... |
medium | 6.8 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-53637 Sylius is an Open Source eCommerce Framework on Symfony. |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-56126 pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the... |
medium | 5.4 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-56127 pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the... |
medium | 5.4 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-56128 pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the... |
medium | 5.4 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-87463 Incorrect authorization in Certificate in Google Chrome on on Android prior to 1... |
medium | 4.8 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87458 UI misrepresentation in Geometry in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87461 Information leak in Core in Google Chrome prior to 153.0.8010.36 allowed a remot... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87462 UI misrepresentation in FedCM in Google Chrome prior to 153.0.8010.36 allowed a... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87465 Incorrect authorization in Downloads in Google Chrome prior to 153.0.8010.36 all... |
medium | 4.2 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87466 Incorrect authorization in Workers in Google Chrome prior to 153.0.8010.36 allow... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87449 Cross-site request forgery in DeviceBoundSessionCredentials in Google Chrome pri... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87432 Incorrect authorization in Navigation in Google Chrome prior to 153.0.8010.36 al... |
medium | 4.2 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87653 UI misrepresentation in FullScreen in Google Chrome on on Windows prior to 153.0... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87635 UI misrepresentation in Payments in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87655 Clickjacking in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remo... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87550 Improper encoding or escaping of output in CSS in Google Chrome prior to 153.0.8... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87545 Information leak in Mobile in Google Chrome on on iOS prior to 153.0.8010.36 all... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87555 Uninitialized resource in GPU in Google Chrome on on Android prior to 153.0.8010... |
medium | 4.7 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87559 UI misrepresentation in UI in Google Chrome prior to 153.0.8010.36 allowed a rem... |
medium | 4.2 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87598 Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87602 Out of bounds read in ANGLE in Google Chrome on on Windows prior to 153.0.8010.3... |
medium | 4.7 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87619 Observable discrepancy in Prefetch in Google Chrome prior to 153.0.8010.36 allow... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87622 Missing authorization in FedCM in Google Chrome prior to 153.0.8010.36 allowed a... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87632 Cross-site scripting in SanitizerAPI in Google Chrome prior to 153.0.8010.36 all... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87562 Incorrect reference resolution in Accessibility in Google Chrome on on Mac prior... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87564 Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote at... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87567 UI misrepresentation in UrlFormatting in Google Chrome prior to 153.0.8010.36 al... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87568 Improper input validation in Chromium in Google Chrome prior to 153.0.8010.36 al... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.