September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-91740 Uninitialized resource in Skia in Google Chrome prior to 153.0.8010.47 allowed a... |
medium | 4.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91742 Confused deputy in PriceTracking in Google Chrome on on iOS prior to 153.0.8010.... |
medium | 4.8 | — | Google / chrome | 2026-09-15 | 2026-09-21 |
| CVE-2026-91720 Uninitialized resource in ANGLE in Google Chrome prior to 153.0.8010.47 allowed... |
medium | 4.7 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91725 Observable discrepancy in CSS in Google Chrome prior to 153.0.8010.47 allowed a... |
medium | 5.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91726 Out of bounds read in WebGL in Google Chrome on on Android prior to 153.0.8010.4... |
medium | 4.7 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91713 Missing authorization in Browser in Google Chrome prior to 153.0.8010.47 allowed... |
medium | 4.2 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91714 Observable discrepancy in Fonts in Google Chrome prior to 153.0.8010.47 allowed... |
medium | 5.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91717 Missing authorization in Android in Google Chrome on on Android prior to 153.0.8... |
medium | 5.1 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-58767 In multiple functions of arm-smmu-v3.c, there is a possible escalation of privil... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58773 In link_load_gnss_image of link_device.c, there is a possible out-of-bounds writ... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58731 In multiple functions of physmem_extmem_linux.c, there is a possible out-of-boun... |
medium | 6.2 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58739 In platform_msg_handler_init of default_msg_handlers.c, there is a possible conf... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58747 In smmu_detach_dev of arm-smmu-v3.c, there is a possible permission bypass due t... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58751 In multiple functions of arm-smmu-v3.c, there is a possible use-after-free due t... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58755 In smmu_install_nested_ste of arm-smmu-v3.c, there is a possible escalation of p... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58765 In GPU, there is a possible permission bypass due to a logic error in the code. |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58716 In multiple locations, there is a possible time-of-check to time-of-use due to a... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58718 In smmu_detach_dev_nested of arm-smmu-v3.c, there is a possible escalation of pr... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58721 In multiple locations, there is a possible information disclosure due to uniniti... |
medium | 4.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58726 In FsmReleaseKey of fsm.c, there is a possible permission bypass due to a missin... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58698 In ap_pmic_poll_msg_handler of ap_pmic_ipc.c, there is a possible permission byp... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56988 In multiple functions of bluetooth_cco.cc, there is a possible use-after-free du... |
medium | 6.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56989 In multiple locations, there is a possible out-of-bounds write due to a missing... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56992 In multiple files, there is a possible permission bypass due to a confused deput... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-57006 In acfw_ffa.c, there is a possible secret read due to a logic error in the code. |
medium | 4.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-57035 In multiple locations, there is a possible out-of-bounds write due to a missing... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-57042 In multiple functions of DreamPickerReceiver.kt, there is a possible permission... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56972 In multiple locations, there is a possible out-of-bounds write due to an incorre... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56973 In multiple locations, there is a possible escalation of privilege due to a logi... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56975 In Cellular Modem, there is a possible denial of service due to improper input v... |
medium | 6.5 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56979 In multiple locations, there is a possible permission bypass due to a logic erro... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56923 In handle_unmap_req of tipc_virtio_dev.c, there is a possible memory corruption... |
medium | 6.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56932 In Trusted Execution Environment, there is a possible memory corruption due to i... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56950 In validate_ns_buf of mbu_class.rs, there is a possible information disclosure d... |
medium | 4.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56958 In gf_algo_get_cached_dump_data of gf_algo.c, there is a possible out-of-bounds... |
medium | 5.5 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56964 In multiple locations, there is a possible use-after-free due to a race conditio... |
medium | 6.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56922 In CPM, there is a possible permission bypass due to a confused deputy. |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56915 In bigo_worker_thread of bigo.c, there is a possible escalation of privilege due... |
medium | 6.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56888 In multiple locations, there is a possible permission bypass due to side channel... |
medium | 6.2 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56889 In multiple locations, there is a possible permission bypass due to an integer o... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.