September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87638 Out of bounds write in Media in Google Chrome prior to 153.0.8010.36 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87643 Integer overflow in GPU in Google Chrome on on Android prior to 153.0.8010.36 al... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87634 Use after free in WebPackaging in Google Chrome prior to 153.0.8010.36 allowed a... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87621 Out of bounds write in ANGLE in Google Chrome on on Windows prior to 153.0.8010.... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87613 Incorrect reference resolution in Extensions in Google Chrome prior to 153.0.801... |
critical | 9.0 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87607 Use after free in Device in Google Chrome on on Mac prior to 153.0.8010.36 allow... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87609 Use after free in Sharing in Google Chrome on on iOS prior to 153.0.8010.36 allo... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87595 Server-side request forgery in Mobile in Google Chrome prior to 153.0.8010.36 al... |
critical | 9.8 | — | Google / chrome | 2026-09-09 | 2026-09-14 |
| CVE-2026-87581 Use after free in Payments in Google Chrome prior to 153.0.8010.36 allowed a rem... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87558 Use after free in Payments in Google Chrome on on Mac prior to 153.0.8010.36 all... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87547 Incorrect reference resolution in FileSystem in Google Chrome prior to 153.0.801... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87544 Incorrect authorization in Extensions in Google Chrome prior to 153.0.8010.36 al... |
critical | 9.8 | — | Google / chrome | 2026-09-09 | 2026-09-18 |
| CVE-2026-87528 Type confusion in Rust in Google Chrome on on Windows prior to 153.0.8010.36 all... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87529 Numeric truncation error in Media in Google Chrome prior to 153.0.8010.36 allowe... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87534 Missing authorization in WebView in Google Chrome on on Android prior to 153.0.8... |
critical | 9.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87520 Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.36 all... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87526 Use after free in Passwords in Google Chrome prior to 153.0.8010.36 allowed a re... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87527 Buffer overflow in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remot... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87512 Use after free in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 al... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87504 Use after free in Core in Google Chrome prior to 153.0.8010.36 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87494 Use after free in Browser in Google Chrome on on Windows prior to 153.0.8010.36... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87500 Improper validation of array index in ANGLE in Google Chrome prior to 153.0.8010... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87488 Use after free in WebGL in Google Chrome on on Android prior to 153.0.8010.36 al... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87492 Incorrect authorization in DevTools in Google Chrome prior to 153.0.8010.36 allo... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87470 Improper quantity validation in Tint in Google Chrome on on Mac prior to 153.0.8... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87474 Use after free in Payments in Google Chrome prior to 153.0.8010.36 allowed a rem... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87464 Use after free in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87448 Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a rem... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87455 Use after free in Aura in Google Chrome prior to 153.0.8010.36 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87438 Out of bounds write in WebGL in Google Chrome on on Android prior to 153.0.8010.... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-58822 In multiple functions of ftsmooth.c, there is a possible memory safety issue due... |
critical | 9.8 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-49921 In multiple locations, there is a possible memory safety issue due to a heap buf... |
critical | 9.8 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-28606 In handleBondStateChanged of AdapterService.java, there is a possible way to ski... |
critical | 9.8 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-85050 Out of bounds write in WebGL in Google Chrome on on Android prior to 152.0.7977.... |
critical | 9.6 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-85047 Improper input validation in Transactions Platform in Google Chrome on on iOS pr... |
critical | 9.6 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-85043 Incomplete cleanup in Network in Google Chrome prior to 152.0.7977.82 allowed a... |
critical | 9.1 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-85042 Use after free in DevTools in Google Chrome prior to 152.0.7977.82 allowed a rem... |
critical | 9.6 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-84352 Use after free in WebGL in Google Chrome on on Android prior to 152.0.7977.75 al... |
critical | 9.6 | — | Google / chrome | 2026-09-02 | 2026-09-08 |
| CVE-2026-84353 Use after free in Shared Tab Groups in Google Chrome on on Android prior to 152.... |
critical | 9.6 | — | Google / chrome | 2026-09-02 | 2026-09-08 |
| CVE-2026-84354 Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.75 al... |
critical | 9.6 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.