September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-56892 In ReadDataElement of common.c, there is a possible information disclosure due t... |
medium | 6.2 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56907 In VPU, there is a possible shared memory overwrite due to improper input valida... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56879 In gmc_mb_msg_handler of gmc_mba.c, there is a possible memory corruption due to... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55365 In multiple functions of remap.c, there is a possible out-of-bounds write due to... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55317 In printf of printf.c, there is a possible out-of-bounds write due to improper i... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55332 In multiple locations, there is a possible out-of-bounds write due to improper i... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55302 In multiple locations, there is a possible permission bypass due to a logic erro... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55304 In addr_remap_address_map of remap.c, there is a possible escalation of privileg... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0177 In do_sss_aes_gcm_256_op of crypto-aes.c, there is a possible out-of-bounds read... |
medium | 4.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0179 In Bootloader, there is a possible permission bypass due to a missing permission... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0183 In CPM, there is a possible information disclosure due to a confused deputy. |
medium | 4.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0186 In ac_init_one_sswrp of init.c, there is a possible escalation of privilege due... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0187 In gsa_sw_pk_hash_compare of image-auth-srv.c, there is a possible escalation of... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0192 In Bootloader, there is a possible escalation of privilege due to a missing perm... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0197 In VPU, there is a possible information dislclosure due to a logic error in the... |
medium | 4.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-83530 A user could provide an expression whose string length is longer than the Parser... |
medium | 4.3 | — | Google / common expression language | 2026-09-09 | 2026-09-23 |
| CVE-2026-87655 Clickjacking in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remo... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87656 Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.3... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-14 |
| CVE-2026-87658 Information leak in Extensions in Google Chrome prior to 153.0.8010.36 allowed a... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87649 UI misrepresentation in Downloads in Google Chrome prior to 153.0.8010.36 allowe... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87651 Incorrect authorization in Paint in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87653 UI misrepresentation in FullScreen in Google Chrome on on Windows prior to 153.0... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87640 Out of bounds read in WebView in Google Chrome on on Android prior to 153.0.8010... |
medium | 6.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87641 Race condition in Browser in Google Chrome prior to 153.0.8010.36 allowed a remo... |
medium | 4.2 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87642 Uninitialized resource in WebGL in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87645 Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.3... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87629 Incorrect authorization in Sources in Google Chrome prior to 153.0.8010.36 allow... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87630 Integer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a rem... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87631 Missing authorization in DOM in Google Chrome prior to 153.0.8010.36 allowed a r... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87632 Cross-site scripting in SanitizerAPI in Google Chrome prior to 153.0.8010.36 all... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87635 UI misrepresentation in Payments in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87619 Observable discrepancy in Prefetch in Google Chrome prior to 153.0.8010.36 allow... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87620 Observable discrepancy in SVG in Google Chrome prior to 153.0.8010.36 allowed a... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87622 Missing authorization in FedCM in Google Chrome prior to 153.0.8010.36 allowed a... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87623 Observable discrepancy in DOM in Google Chrome prior to 153.0.8010.36 allowed a... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87624 UI misrepresentation in Passwords in Google Chrome on on Android prior to 153.0.... |
medium | 4.2 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87626 Incorrect authorization in DeviceBoundSessionCredentials in Google Chrome prior... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-87627 Interpretation conflict in Safebrowsing in Google Chrome on on Mac prior to 153.... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-14 |
| CVE-2026-87610 Incorrect authorization in Omnibox in Google Chrome prior to 153.0.8010.36 allow... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-87615 Race condition in Payments in Google Chrome prior to 153.0.8010.36 allowed a rem... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.