September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-102331 Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.92 a... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102316 Use after free in Views in Google Chrome prior to 154.0.8037.92 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102304 Use after free in Passwords in Google Chrome prior to 154.0.8037.92 allowed a re... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102306 Use after free in Bluetooth in Google Chrome prior to 154.0.8037.92 allowed a re... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102308 Use after free in Views in Google Chrome prior to 154.0.8037.92 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102309 Use after free in FullScreen in Google Chrome prior to 154.0.8037.92 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95356 Use after free in WindowDialog in Google Chrome prior to 154.0.8037.57 allowed a... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95357 Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95347 Use after free in Updater in Google Chrome on on Mac prior to 154.0.8037.57 allo... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95349 Buffer overflow in WebGL in Google Chrome on on Android prior to 154.0.8037.57 a... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95350 Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 a... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95339 Use after free in ServiceWorker in Google Chrome prior to 154.0.8037.57 allowed... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95329 Out of bounds write in WebGL in Google Chrome on on Android prior to 154.0.8037.... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95331 Out of bounds write in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95318 Buffer overflow in Video in Google Chrome prior to 154.0.8037.57 allowed a remot... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95325 Use after free in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95310 Use after free in AdFilter in Google Chrome prior to 154.0.8037.57 allowed a rem... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95311 Free of non-heap memory in Fonts in Google Chrome prior to 154.0.8037.57 allowed... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95313 Use after free in Fullscreen in Google Chrome prior to 154.0.8037.57 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95299 Use after free in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote a... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95284 Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 a... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-95277 Use after free in Views in Google Chrome prior to 154.0.8037.57 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95281 Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 a... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95283 Buffer overflow in Tint in Google Chrome on on Android prior to 154.0.8037.57 al... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-93372 Buffer overflow in WebGL in Google Chrome on on Android prior to 153.0.8010.52 a... |
critical | 9.6 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-93373 Use after free in Extensions in Google Chrome prior to 153.0.8010.52 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-93374 Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.52 all... |
critical | 9.6 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-91749 Use after free in Workers in Google Chrome prior to 153.0.8010.47 allowed a remo... |
critical | 9.6 | — | Google / chrome | 2026-09-15 | 2026-09-24 |
| CVE-2026-91738 Improper input validation in ANGLE in Google Chrome prior to 153.0.8010.47 allow... |
critical | 9.6 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91728 Integer overflow in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91729 Use after free in DigitalCredentials in Google Chrome prior to 153.0.8010.47 all... |
critical | 9.6 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91716 Use after free in Auth in Google Chrome prior to 153.0.8010.47 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91718 Use after free in Core in Google Chrome prior to 153.0.8010.47 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91710 Use after free in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed... |
critical | 9.6 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-56960 In multiple locations, there is a possible use-after-free due to a logic error i... |
critical | 9.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55366 In IP Multimedia Subsystem, there is a possible authentication bypass due to a l... |
critical | 9.8 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-87646 Use after free in Web Authentication in Google Chrome prior to 153.0.8010.36 all... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87650 Out of bounds read in WebGL in Google Chrome prior to 153.0.8010.36 allowed a re... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87654 Buffer overflow in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 a... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87637 Use after free in Extensions in Google Chrome on on Mac prior to 153.0.8010.36 a... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.