September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-102315 Uninitialized resource in Media in Google Chrome on on Windows prior to 154.0.80... |
low | 3.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95359 Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037... |
low | 3.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95324 Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.57 allowed a... |
low | 3.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95312 Information leak in Passwords in Google Chrome prior to 154.0.8037.57 allowed a... |
low | 3.1 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95316 Unchecked return value in Performance in Google Chrome prior to 154.0.8037.57 al... |
low | 2.9 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95317 Incorrect authorization in MediaCapture in Google Chrome prior to 154.0.8037.57... |
low | 3.1 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95302 Incorrect authorization in WebAPKs in Google Chrome on on Android prior to 154.0... |
low | 2.9 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95308 Integer overflow in Metrics in Google Chrome prior to 154.0.8037.57 allowed a re... |
low | 3.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-93378 Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed... |
low | 3.1 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-93380 Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a r... |
low | 3.1 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-93384 Server-side request forgery in Omnibox in Google Chrome on on Android prior to 1... |
low | 3.7 | — | Google / chrome | 2026-09-17 | 2026-09-18 |
| CVE-2026-91747 Use after free in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote... |
low | 3.1 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91730 Incomplete cleanup in GetUserMedia in Google Chrome prior to 153.0.8010.47 allow... |
low | 3.1 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91723 Race condition in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed... |
low | 3.1 | — | Google / chrome | 2026-09-15 | 2026-09-18 |
| CVE-2026-91708 Race condition in Network in Google Chrome prior to 153.0.8010.47 allowed a remo... |
low | 3.1 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-87657 Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote at... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87647 Uninitialized resource in GPU in Google Chrome prior to 153.0.8010.36 allowed a... |
low | 3.4 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87652 Incorrect authorization in PushAPI in Google Chrome prior to 153.0.8010.36 allow... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87611 Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allo... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87614 Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87576 Uninitialized resource in GPU in Google Chrome on on Android prior to 153.0.8010... |
low | 3.4 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87539 Observable discrepancy in Network in Google Chrome prior to 153.0.8010.36 allowe... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87531 Information leak in CORS in Google Chrome prior to 153.0.8010.36 allowed a remot... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87521 Information leak in WebMCP in Google Chrome prior to 153.0.8010.36 allowed a rem... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87525 Out of bounds read in Chromoting in Google Chrome on on Windows prior to 153.0.8... |
low | 2.7 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87517 Race condition in Mobile in Google Chrome on on iOS prior to 153.0.8010.36 allow... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87498 Missing authorization in WebUI in Google Chrome prior to 153.0.8010.36 allowed a... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87485 Incorrect authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87451 Information leak in Downloads in Google Chrome prior to 153.0.8010.36 allowed a... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87452 Incorrect authorization in GPU in Google Chrome on on Mac prior to 153.0.8010.36... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87456 Uninitialized resource in Media in Google Chrome prior to 153.0.8010.36 allowed... |
low | 3.4 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87442 Confused deputy in Prerender in Google Chrome prior to 153.0.8010.36 allowed a r... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87434 Missing authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-55290 In setTo of ResourceTypes.cpp, there is a possible out-of-bounds heap read due t... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-49895 In get_eht_operation_channel_width of ieee802_11_common.c, there is a possible o... |
low | 3.5 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-28671 In updateInternal of MediaProvider.java, there is a possible expose contents of... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-23 |
| CVE-2026-45519 In screenArgsForPermissionCheckIfAny of multiple locations there is a possible r... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-45521 In openFile of AppFuseBridge.java, there is a possible information disclosure du... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-45525 In multiple locations, there is a possible improper data sanitization due to a l... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-28660 In getAllSessions of multiple files, there is a possible confused deputy due to... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.