September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,364
Critical
1,230
High
4,374
Medium
4,126
Low
462
Severity not reported
1,172
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-91722 Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91733 Improper state validation in Skia in Google Chrome prior to 153.0.8010.47 allowe... |
high | 8.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91734 Incorrect authorization in Core in Google Chrome on on Windows prior to 153.0.80... |
high | 7.4 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91735 Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.47 allowed... |
high | 8.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91736 Use after free in DOM in Google Chrome prior to 153.0.8010.47 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91737 Use after free in PDF in Google Chrome prior to 153.0.8010.47 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91721 Use after free in Internals in Google Chrome prior to 153.0.8010.47 allowed a re... |
high | 8.8 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91715 Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed... |
high | 8.8 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91712 Race condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 a... |
high | 8.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91711 Out of bounds write in ServiceWorker in Google Chrome prior to 153.0.8010.47 all... |
high | 8.8 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91709 Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed... |
high | 8.8 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-28590 In multiple locations, there is a possible improper encryption key validation du... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28583 In validate_camera_metadata_structure of camera_metadata.c, there is a possible... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28572 In onCreate of InstallLaunch.kt, there is a possible misleading UI due to a tapj... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-0084 In multiple functions of HostEmulationManager.java, there is a possible backgrou... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-0065 In areBackgroundActivityStartsAllowed of BackgroundLaunchProcessController.java,... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28607 In multiple functions in multiple locations, there is a possible background acti... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28604 In multiple locations, there is a possible use after free due to a race conditio... |
high | 7.5 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28603 In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a p... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28602 In setClipboardAccessNotificationsEnabledForUser of ClipboardService.java, there... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28600 In onCreate of PaymentDefaultDialog.java, there is a possible way to change defa... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28599 In addCreatorToken of ActivityManagerService.java, there is a possible Intent Re... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28594 In multiple locations, there is a possible use after free due to a logic error i... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28593 In getItemList of SettingsFragment.java, there is a possible user interaction by... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28620 In multiple locations, there is a possible unauthorized URI access due to a perm... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28618 In dec_frm_prepare of oapv.c, there is a possible OOB write due to a heap buffer... |
high | 8.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28616 In Setup Wizard, there is a possible way to force connection to a malicious netw... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28614 In onCreate of SlicePermissionActivity.java, there is a possible permission bypa... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28613 In initAppLinkTypeAndIntent of ChannelImpl.java, there is a possible launch an a... |
high | 7.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28612 In resolveActivity of ActivityStarter.java, there is a possible way to perform I... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28611 In multiple functions of NfcService.java, there is a possible silent payment ses... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28609 In read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to... |
high | 8.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28662 In p2p_process_prov_disc_bootstrap_req of p2p_pd.c, there is a possible out of b... |
high | 8.0 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28658 In findMetaAuthUid of AccountsDb.java, there is a possible frp bypass due to a l... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28657 In onActivityResult of AppWidgetConfigActivityProxy.java, there is a possible un... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28656 In multiple functions of DeviceAdminAdd.java, there is a possible way to an over... |
high | 7.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28655 In multiple functions of RemoteViews.java, there is a possible background activi... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28650 In setHiddenWhileSuspended of WindowState.java, there is a possible overlay bypa... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28644 In startNextMatchingActivity of ActivityTaskManagerService.java, there is a poss... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28642 In executeRequest of ActivityStarter.java, there is a possible background activi... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.