September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87473 Incorrect authorization in FileHandling in Google Chrome prior to 153.0.8010.36... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-15 |
| CVE-2026-87458 UI misrepresentation in Geometry in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87459 Observable discrepancy in Select in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87461 Information leak in Core in Google Chrome prior to 153.0.8010.36 allowed a remot... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87462 UI misrepresentation in FedCM in Google Chrome prior to 153.0.8010.36 allowed a... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87463 Incorrect authorization in Certificate in Google Chrome on on Android prior to 1... |
medium | 4.8 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87447 Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allow... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87449 Cross-site request forgery in DeviceBoundSessionCredentials in Google Chrome pri... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87453 Confused deputy in BackgroundFetch in Google Chrome prior to 153.0.8010.36 allow... |
medium | 5.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87454 Information leak in Enterprise in Google Chrome on on Windows prior to 153.0.801... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87439 Information leak in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowe... |
medium | 5.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87441 Missing authorization in Downloads in Google Chrome prior to 153.0.8010.36 allow... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87443 Missing authorization in Actor in Google Chrome prior to 153.0.8010.36 allowed a... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87445 UI misrepresentation in Session in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87446 Incomplete cleanup in Extensions in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87429 Missing authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 a... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87432 Incorrect authorization in Navigation in Google Chrome prior to 153.0.8010.36 al... |
medium | 4.2 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87435 Information leak in ControlledFrame in Google Chrome prior to 153.0.8010.36 allo... |
medium | 5.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87436 Incomplete cleanup in Browser in Google Chrome prior to 153.0.8010.36 allowed a... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87437 Information leak in Frames in Google Chrome prior to 153.0.8010.36 allowed a rem... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-49883 In checkReadPermission of PermissionsManager.java, there is a possible way to mo... |
medium | 5.5 | — | Google / android | 2026-09-08 | 2026-09-14 |
| CVE-2026-55256 In parsePartHeaders of multiple files, there is a possible persistent denial of... |
medium | 6.5 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-45527 In convertCleanApertureToRect of HeifCleanAperture.cpp, there is a possible way... |
medium | 4.3 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-28627 In btm_sec_encrypt_change of btm_sec.cc, there is a possible downgrade attack du... |
medium | 4.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28633 In initForUserNoTracing of VoiceInteractionManagerService.java, there is a possi... |
medium | 5.5 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28617 In add of WifiNetworkSuggestionsManager.java, there is a possible persistent DOS... |
medium | 5.5 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28596 In parseInterventionFromXml of GameManagerService.java, there is a possible perm... |
medium | 5.5 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28584 In createSessionInternal of PackageInstallerService.java, there is a possible wa... |
medium | 5.5 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-85044 Use of released resource in Mobile in Google Chrome on on Android prior to 152.0... |
medium | 6.5 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-84356 UI misrepresentation in FullScreen in Google Chrome prior to 152.0.7977.75 allow... |
medium | 4.3 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84357 Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 all... |
medium | 6.5 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84358 Improper privilege management in Downloads in Google Chrome prior to 152.0.7977.... |
medium | 4.2 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84332 Incorrect authorization in SiteSettings in Google Chrome prior to 152.0.7977.75... |
medium | 6.5 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84348 Information leak in MediaCapture in Google Chrome prior to 152.0.7977.75 allowed... |
medium | 6.5 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84323 Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allo... |
medium | 5.3 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84327 Incorrect authorization in Autofill in Google Chrome on on Android prior to 152.... |
medium | 6.5 | — | Google / chrome | 2026-09-02 | 2026-09-08 |
| CVE-2026-84329 Confused deputy in CredentialProvider in Google Chrome on on Windows prior to 15... |
medium | 5.3 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84330 UI misrepresentation in FullScreen in Google Chrome on on Android prior to 152.0... |
medium | 5.4 | — | Google / chrome | 2026-09-02 | 2026-09-08 |
| CVE-2026-102319 Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.92 allowed a... |
low | 3.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102311 Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037... |
low | 3.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.