September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100828 Mitigation bypass in the Bookmarks & History component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100829 Mitigation bypass in the DOM: Security component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100818 Sandbox escape due to use-after-free in the Widget: Gtk component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100819 Sandbox escape due to incorrect boundary conditions in the XPCOM component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100810 Other issue in the DevTools component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100811 Sandbox escape due to use-after-free in the DOM: Core & HTML component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100800 Sandbox escape due to use-after-free in the Disability Access APIs component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100804 Sandbox escape due to use-after-free in the Preferences: Backend component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100794 Sandbox escape due to incorrect boundary conditions in the Internationalization... |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100781 Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender c... |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100786 Sandbox escape due to use-after-free in the Graphics component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100787 Sandbox escape in the XUL component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100788 Invalid pointer in the JavaScript: WebAssembly component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100775 Sandbox escape in the Graphics component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-06 |
| CVE-2026-100778 Sandbox escape due to use-after-free in the DOM: Core & HTML component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100770 Sandbox escape due to use-after-free in the DOM: Content Processes component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-06 |
| CVE-2026-100758 Sandbox escape in the DOM: Navigation component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100760 Sandbox escape in the Security: Process Sandboxing component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100762 Sandbox escape due to use-after-free in the DOM: Content Processes component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100763 Incorrect boundary conditions in the Graphics: WebGPU component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-92238 A maliciously constructed mail header could lead to multiple fields being parsed... |
critical | 9.8 | — | Mozilla / thunderbird | 2026-09-15 | 2026-09-24 |
| CVE-2026-92240 A malicious or compromised IMAP server can trigger an out-of-bounds read in the... |
critical | 9.1 | — | Mozilla / thunderbird | 2026-09-15 | 2026-09-24 |
| CVE-2026-92075 Mitigation bypass in the Networking component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92079 Mitigation bypass in the Widget: Win32 component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92066 Sandbox escape in the Profile Backup component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92071 Sandbox escape due to incorrect boundary conditions in the Widget: Win32 compone... |
critical | 9.6 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92057 Mitigation bypass in the Enterprise Policies component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92059 Incorrect boundary conditions in the DOM: Editor component. |
critical | 9.3 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92061 Incorrect boundary conditions in the Security: Process Sandboxing component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92048 Sandbox escape due to incorrect boundary conditions in the Widget: Win32 compone... |
critical | 9.0 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92050 Sandbox escape due to race condition in the XPConnect component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92051 Spoofing issue due to invalid pointer in the Graphics component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92037 Incorrect boundary conditions in the DOM: Animation component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92038 Mitigation bypass in the Remote Settings Client component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92041 Mitigation bypass in the DOM: Networking component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92045 Sandbox escape due to incorrect boundary conditions in the WebRTC component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92032 Sandbox escape due to invalid pointer in the Graphics component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92034 Site isolation issue in the Graphics component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92035 Sandbox escape due to incorrect boundary conditions in the Graphics component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92036 Incorrect boundary conditions in the Networking: HTTP component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.