September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,364
Critical
1,230
High
4,374
Medium
4,126
Low
462
Severity not reported
1,172
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (964), google (608), oracle (274), apple (244), adobe (197), dell (138), ibm (104), arubanetworks (101), mongodb (64), apache (56)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-102320 Missing authorization in CORS in Google Chrome prior to 154.0.8037.92 allowed a... |
medium | 6.5 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102329 Cross-site scripting in WebUI in Google Chrome prior to 154.0.8037.92 allowed a... |
medium | 6.1 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102330 Incorrect authorization in SiteIsolation in Google Chrome prior to 154.0.8037.92... |
medium | 6.5 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-93379 Incorrect authorization in ORB in Google Chrome prior to 153.0.8010.52 allowed a... |
medium | 4.3 | — | Google / chrome | 2026-09-17 | 2026-09-30 |
| CVE-2026-102305 UI misrepresentation in SignIn in Google Chrome on on iOS prior to 154.0.8037.92... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95287 Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allo... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95288 UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95289 Incorrect authorization in Scroll in Google Chrome prior to 154.0.8037.57 allowe... |
medium | 4.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95291 UI misrepresentation in SecurityIndicators in Google Chrome on on iOS prior to 1... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95292 Incorrect authorization in Safebrowsing in Google Chrome prior to 154.0.8037.57... |
medium | 4.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95293 Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.57 allowed a... |
medium | 4.7 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95320 Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allo... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95323 UI misrepresentation in Chromium in Google Chrome on on iOS prior to 154.0.8037.... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95336 Information leak in Transactions Platform in Google Chrome prior to 154.0.8037.5... |
medium | 6.5 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95346 UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allow... |
medium | 4.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95352 Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allo... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102313 Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 154.0.80... |
medium | 4.7 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102314 UI misrepresentation in TabStrip in Google Chrome prior to 154.0.8037.92 allowed... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102318 Out of bounds read in WebGL in Google Chrome prior to 154.0.8037.92 allowed a re... |
medium | 4.7 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95279 UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.80... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95332 Use of uninitialized variable in Tint in Google Chrome on on Android prior to 15... |
medium | 4.7 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95337 UI misrepresentation in Messages in Google Chrome on on Android prior to 154.0.8... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95321 UI misrepresentation in Payments in Google Chrome on on Android prior to 154.0.8... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102325 Uninitialized resource in Skia in Google Chrome prior to 154.0.8037.92 allowed a... |
medium | 4.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95328 Confused deputy in Mobile in Google Chrome on on Android prior to 154.0.8037.57... |
medium | 6.5 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102303 Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037... |
medium | 4.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102307 Uninitialized resource in Dawn in Google Chrome on on Android prior to 154.0.803... |
medium | 4.7 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-13018 Insufficient validation of untrusted input in Codecs in Google Chrome prior to 1... |
medium | 4.3 | — | Google / chrome | 2026-09-28 | 2026-09-29 |
| CVE-2026-55256 In parsePartHeaders of multiple files, there is a possible persistent denial of... |
medium | 6.5 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-45527 In convertCleanApertureToRect of HeifCleanAperture.cpp, there is a possible way... |
medium | 4.3 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-83530 A user could provide an expression whose string length is longer than the Parser... |
medium | 4.3 | — | Google / common expression language | 2026-09-09 | 2026-09-23 |
| CVE-2026-0177 In do_sss_aes_gcm_256_op of crypto-aes.c, there is a possible out-of-bounds read... |
medium | 4.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0179 In Bootloader, there is a possible permission bypass due to a missing permission... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0183 In CPM, there is a possible information disclosure due to a confused deputy. |
medium | 4.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0186 In ac_init_one_sswrp of init.c, there is a possible escalation of privilege due... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0187 In gsa_sw_pk_hash_compare of image-auth-srv.c, there is a possible escalation of... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0192 In Bootloader, there is a possible escalation of privilege due to a missing perm... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0197 In VPU, there is a possible information dislclosure due to a logic error in the... |
medium | 4.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55302 In multiple locations, there is a possible permission bypass due to a logic erro... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55304 In addr_remap_address_map of remap.c, there is a possible escalation of privileg... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.