September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,364
Critical
1,230
High
4,374
Medium
4,126
Low
462
Severity not reported
1,172
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-28639 In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write d... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28626 In onCreate of SetupPassthroughActivity.java, there is a possible way to launch... |
high | 7.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28624 In multiple locations, there is a possible read/write access to files without th... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28653 In multiple functions of rw_t3t.cc, there is a possible out of bounds write due... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28636 In setupLayout of PickActivity.java, there is a possible bypass of the "Install... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28634 In handleUssdRequest of PhoneInterfaceManager.java, there is a possible way to s... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28631 In buildMiniResolver of IntentForwarderActivity.java, there is a possible consen... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-87608 Improper certificate validation in FedCM in Google Chrome prior to 153.0.8010.36... |
high | 7.5 | — | Google / chrome | 2026-09-09 | 2026-09-14 |
| CVE-2026-87606 Missing authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36 a... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-87471 Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87431 Missing authorization in Extensions in Google Chrome prior to 153.0.8010.36 allo... |
high | 7.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87499 Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allow... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87505 Incorrect authorization in FileSystem in Google Chrome prior to 153.0.8010.36 al... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87537 Missing authorization in Extensions in Google Chrome prior to 153.0.8010.36 allo... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87536 Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87533 Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a loc... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87569 Missing authorization in Views in Google Chrome prior to 153.0.8010.36 allowed a... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87570 Incorrect authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87433 Race condition in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remo... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87450 Incorrect authorization in Permissions in Google Chrome prior to 153.0.8010.36 a... |
high | 7.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87644 Incorrect authorization in Views in Google Chrome on on Windows prior to 153.0.8... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87648 Use after free in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 al... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87633 Use after free in Views in Google Chrome prior to 153.0.8010.36 allowed a local... |
high | 8.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87636 Type confusion in XML in Google Chrome prior to 153.0.8010.36 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87639 Use after free in WebPackaging in Google Chrome prior to 153.0.8010.36 allowed a... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87617 Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87618 Incorrect reference resolution in Storage in Google Chrome on on Windows prior t... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87625 Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87628 Use after free in Cast in Google Chrome prior to 153.0.8010.36 allowed an adjace... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87604 Out of bounds read in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a re... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87612 Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87616 Improper initialization in Views in Google Chrome on on Windows prior to 153.0.8... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87582 Confused deputy in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87585 Double free in PDFium in Google Chrome on on Windows prior to 153.0.8010.36 allo... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87587 Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87588 Use after free in Chromecast in Google Chrome prior to 153.0.8010.36 allowed a r... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87601 Race condition in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote at... |
high | 7.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87554 Race condition in Chromoting in Google Chrome on on Windows prior to 153.0.8010.... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87572 Injection in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote a... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87578 Use after free in Receiver in Google Chrome prior to 153.0.8010.36 allowed an ad... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.