September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,364
Critical
1,230
High
4,374
Medium
4,126
Low
462
Severity not reported
1,172
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84324 Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote... |
critical | 9.0 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84325 Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.7... |
critical | 9.8 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-95306 Type confusion in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95298 Use after free in Browser in Google Chrome prior to 154.0.8037.57 allowed a loca... |
high | 7.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95304 Out of bounds write in V8 in Google Chrome prior to 154.0.8037.57 allowed a remo... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95274 Improper output encoding in DevTools in Google Chrome prior to 154.0.8037.57 all... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95276 Improper input validation in Themes in Google Chrome prior to 154.0.8037.57 allo... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95280 Race condition in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote at... |
high | 7.5 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95286 Type confusion in Bindings in Google Chrome prior to 154.0.8037.57 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95282 Use after free in Platform in Google Chrome prior to 154.0.8037.57 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95315 Use after free in Aura in Google Chrome prior to 154.0.8037.57 allowed a local a... |
high | 7.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95319 Use after free in Printing in Google Chrome prior to 154.0.8037.57 allowed a rem... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95333 Use after free in Metrics in Google Chrome prior to 154.0.8037.57 allowed a remo... |
high | 8.1 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95334 Incorrect reference resolution in WebProtect in Google Chrome prior to 154.0.803... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95335 Use after free in HID in Google Chrome prior to 154.0.8037.57 allowed a remote a... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95338 Use after free in PDFium in Google Chrome prior to 154.0.8037.57 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95341 Improper input validation in Desktop in Google Chrome prior to 154.0.8037.57 all... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95343 Use after free in WebAudio in Google Chrome prior to 154.0.8037.57 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95345 Use after free in Actor in Google Chrome prior to 154.0.8037.57 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95348 Use after free in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed a re... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95351 Use after free in Views in Google Chrome prior to 154.0.8037.57 allowed a remote... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95353 Use after free in Bindings in Google Chrome prior to 154.0.8037.57 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95354 Use after free in Verifier in Google Chrome prior to 154.0.8037.57 allowed a rem... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95355 Incorrect authorization in Navigation in Google Chrome on on iOS prior to 154.0.... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102317 Improper privilege management in Mojo in Google Chrome on on Windows prior to 15... |
high | 8.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102321 Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102323 Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102324 Use after free in PictureInPicture in Google Chrome prior to 154.0.8037.92 allow... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102326 Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102328 Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95322 Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102327 Incorrect authorization in WebView in Google Chrome on on Android prior to 154.0... |
high | 7.5 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-55285 In openLogicalChannel of multiple files, there is a possible out-of-bounds write... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-25 |
| CVE-2026-55277 In checkUiccListenConfigNeeded of RoutingManager.cpp, there is a possible out of... |
high | 8.0 | — | Google / android | 2026-09-08 | 2026-09-25 |
| CVE-2026-55273 In AppendCommentLine of AnnotationProcessor.cpp, there is a possible supply chai... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-25 |
| CVE-2026-55294 In ihevcd_get_tu_data_size of ihevcd_utils.c, there is a possible out of bounds... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-58874 In multiple functions of SmsController.java, there is a possible escalation of p... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-58941 In multiple functions of iommu.c, there is a possible out of bounds read/write d... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-19201 An uncontrolled recursion vulnerability in the Windows SIPA event log parser of... |
high | 7.5 | — | Google / go-attestation | 2026-09-09 | 2026-09-24 |
| CVE-2026-58820 In multiple locations, there is a possible memory safety issue due to integer ov... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.