September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-28638 In multiple functions of XmpDataParser.java, there is a possible improper data s... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28652 In multiple functions of RangingServiceImpl.java, there is a possible MITM due t... |
low | 3.1 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28622 In getQueryBuilderInternal of MediaProvider.java, there is a possible way to ret... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28623 In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28630 In onCreate of ContactsPickerActivity.kt, there is a possible misleading UI due... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28582 In onCreate of ConfirmDeviceCredentialActivity.java, there is a possible unautho... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-0054 In isCallerAllowed of WalletContextualLocationsService.kt, there is a possible w... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-85052 Out of bounds read in CrashReporting in Google Chrome prior to 152.0.7977.82 all... |
low | 3.1 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-84355 Incorrect authorization in Navigation in Google Chrome prior to 152.0.7977.75 al... |
low | 3.1 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84359 Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remot... |
low | 3.1 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84328 Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allo... |
low | 3.1 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84331 Incorrect authorization in Actor in Google Chrome prior to 152.0.7977.75 allowed... |
low | 3.1 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.