September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,364
Critical
1,230
High
4,374
Medium
4,126
Low
462
Severity not reported
1,172
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-56945 In VPU, there is a possible out-of-bounds write due to a confused deputy. |
high | 7.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56942 In ReadTileInfo of vp9hwd_headers.cc, there is a possible out-of-bounds write du... |
high | 8.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56941 In multiple functions of fpc_tee_hal.c, there is a possible use-after-free due t... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56914 In multiple locations, there is a possible use-after-free due to improper lockin... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-93375 Incorrect reference resolution in Tracing in Google Chrome on on Windows prior t... |
high | 8.1 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-93381 Buffer overflow in PDFium in Google Chrome on on Windows prior to 153.0.8010.52... |
high | 8.8 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-93377 Type confusion in V8 in Google Chrome prior to 153.0.8010.52 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-93382 Use after free in PDFium in Google Chrome prior to 153.0.8010.52 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-09-17 | 2026-09-19 |
| CVE-2026-56986 In multiple files, there is a possible out-of-bounds read due to type confusion. |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56970 In multiple locations, there is a possible permission bypass due to a missing pe... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56974 In Start of AudioRtpPayloadEncoderNode.cpp, there is a possible out-of-bounds wr... |
high | 8.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56978 In get_global_config_item_addr of gc.c, there is a possible out-of-bounds read d... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56982 In VPU, there is a possible permission bypass due to a missing permission check. |
high | 7.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56985 In multiple files, there is a possible way to obtain signatures due to type conf... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-57012 In the Setup Wizard, there is a possible remote package install due to a missing... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56997 In Av1DecodeFrameTag of vp9hwd_headers.cc, there is a possible out-of-bounds wri... |
high | 8.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-57008 In Modem, there is a possible information disclosure due to improper input valid... |
high | 7.5 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58678 In Bootloader, there is a possible permission bypass due to a logic error in the... |
high | 7.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58679 In gf_ta_test_set_config of gf_ta_test.c, there is a possible heap buffer overfl... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-57014 In phNxpNciHal_ext_process_nfc_init_rsp of phNxpNciHal_ext.cc, there is a possib... |
high | 7.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58683 In IP Multimedia Subsystem, there is a possible out-of-bounds write due to impro... |
high | 8.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58691 In FsmReleaseKey of fsm.c, there is a possible permission bypass due to improper... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58695 In gmc_phy_lp3_exit_restore_registers of phy_power.c, there is a possible escala... |
high | 7.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-91732 Missing authorization in AppManifest in Google Chrome prior to 153.0.8010.47 all... |
high | 8.1 | — | Google / chrome | 2026-09-15 | 2026-09-18 |
| CVE-2026-91719 Code injection in XML in Google Chrome prior to 153.0.8010.47 allowed a remote a... |
high | 8.1 | — | Google / chrome | 2026-09-15 | 2026-09-18 |
| CVE-2026-58699 In Vp9DecEndOfStream of vp9hwd_output.cc, there is a possible out-of-bounds read... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58701 In trusty_dputc of generic-arm64-smcall.c, there is a possible out-of-bounds wri... |
high | 7.0 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58710 In DecodeFilmGrainParams of film_grain_dec.cc, there is a possible out-of-bounds... |
high | 8.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58766 In multiple functions of arm-smmu-v3.c, there is a possible escalation of privil... |
high | 7.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58744 In multiple locations, there is a possible escalation of privilege due to improp... |
high | 7.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58734 In google_mba_recv_msg of google_mba_poll.c, there is a possible out-of-bounds w... |
high | 7.0 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58728 In ARM64_TLBI of mmu.h, there is a possible memory corruption due to a race cond... |
high | 7.0 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58724 In multiple locations, there is a possible use-after-free due to a race conditio... |
high | 7.0 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-91741 Type confusion in CacheStorage in Google Chrome prior to 153.0.8010.47 allowed a... |
high | 8.8 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91743 Race condition in Core in Google Chrome prior to 153.0.8010.47 allowed a remote... |
high | 8.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91745 Use after free in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91748 Race condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 a... |
high | 8.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91731 Type confusion in Compositing in Google Chrome prior to 153.0.8010.47 allowed a... |
high | 8.8 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91727 Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to... |
high | 8.1 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91724 Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote... |
high | 8.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.