September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,321
Critical
1,226
High
4,361
Medium
4,108
Low
460
Severity not reported
1,166
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87613 Incorrect reference resolution in Extensions in Google Chrome prior to 153.0.801... |
critical | 9.0 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87581 Use after free in Payments in Google Chrome prior to 153.0.8010.36 allowed a rem... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87558 Use after free in Payments in Google Chrome on on Mac prior to 153.0.8010.36 all... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87547 Incorrect reference resolution in FileSystem in Google Chrome prior to 153.0.801... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87528 Type confusion in Rust in Google Chrome on on Windows prior to 153.0.8010.36 all... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87529 Numeric truncation error in Media in Google Chrome prior to 153.0.8010.36 allowe... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87512 Use after free in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 al... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87520 Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.36 all... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87526 Use after free in Passwords in Google Chrome prior to 153.0.8010.36 allowed a re... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87527 Buffer overflow in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remot... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87500 Improper validation of array index in ANGLE in Google Chrome prior to 153.0.8010... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87504 Use after free in Core in Google Chrome prior to 153.0.8010.36 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87488 Use after free in WebGL in Google Chrome on on Android prior to 153.0.8010.36 al... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87492 Incorrect authorization in DevTools in Google Chrome prior to 153.0.8010.36 allo... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87470 Improper quantity validation in Tint in Google Chrome on on Mac prior to 153.0.8... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87474 Use after free in Payments in Google Chrome prior to 153.0.8010.36 allowed a rem... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87448 Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a rem... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87455 Use after free in Aura in Google Chrome prior to 153.0.8010.36 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87438 Out of bounds write in WebGL in Google Chrome on on Android prior to 153.0.8010.... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-85103 A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unau... |
critical | 9.8 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-67401 A vulnerability in cPanel allows a mail-enabled account to achieve remote code e... |
critical | 9.9 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2022-41352 Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability |
critical | 9.8 | Listed | Synacor / Zimbra Collaboration Suite (ZCS) | 2022-09-26 | 2026-09-10 |
| CVE-2016-4117 Adobe Flash Player Arbitrary Code Execution Vulnerability |
critical | 9.8 | Listed | Adobe / Flash Player | 2016-05-11 | 2026-09-10 |
| CVE-2026-75604 Next.js is a React framework for building full-stack web applications. |
critical | 9.0 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-84372 Predis is a flexible and feature-complete Redis and Valkey client for PHP. |
critical | 9.8 | — | — | 2026-09-01 | 2026-09-09 |
| CVE-2026-53611 Looking Glass is a modern, stateless network-diagnostic platform — a single self... |
critical | 9.8 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-53649 Joro is a web exploitation framework. |
critical | 9.6 | — | — | 2026-09-02 | 2026-09-09 |
| CVE-2026-58400 GeoNetwork is a catalog application to manage spatially referenced resources. |
critical | 9.1 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-85061 MapLibre GL JS is an interactive vector tile map library for web browsers. |
critical | 10.0 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-85506 ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _get_del... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-71625 An issue in slimkit plus ThinkSNS+ v.2.4 allows a remote attacker to escalate pr... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-85391 Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compo... |
critical | 9.8 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-50894 easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous T... |
critical | 9.8 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-22590 eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service)... |
critical | 9.1 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-79571 Incorrect access control in the SellerAuthorizeAspect component of springboot-pr... |
critical | 9.1 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-79574 An issue in the gateway server of mpush v0.8.1 allows attackers to execute arbit... |
critical | 9.8 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-78997 UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314) contains... |
critical | 9.3 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-80129 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
critical | 9.8 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-09 |
| CVE-2026-80131 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
critical | 9.8 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-09 |
| CVE-2026-80164 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
critical | 9.1 | — | Dell / secure connect gateway | 2026-09-07 | 2026-09-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.