Independent & educational platform Not a government body. No link or affiliation with any government organisation. Made for learning only. Test only systems you own or are authorised to test. Become a Partner or Sponsor → Full disclaimer

September 2026 CVE archive

Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.

Published in September 2026Materially updated (Critical / KEV)
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32

Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)

CVESeverityCVSSKEVVendor / productPublishedModified
CVE-2026-92018
Sandbox escape in the DOM: Core & HTML component.
 critical 9.6 —Mozilla / firefox 2026-09-152026-10-06
CVE-2026-84637
Malicious calendar invitations could use file URI attachments to launch local or...
 critical 9.8 —Mozilla / thunderbird 2026-09-012026-09-03
CVE-2026-84639
Triggering an error condition in certain MIME bodies would cause uninitialized m...
 critical 9.1 —Mozilla / thunderbird 2026-09-012026-09-03
CVE-2026-84140
Site isolation issue in the DOM: Navigation component.
 critical 9.8 —Mozilla / firefox 2026-09-012026-09-03
CVE-2026-84141
Integer overflow in the Graphics: ImageLib component.
 critical 9.8 —Mozilla / firefox 2026-09-012026-09-03
CVE-2026-84142
Internally found bugs present in Thunderbird 154.
 critical 9.8 —Mozilla / firefox 2026-09-012026-09-03
CVE-2026-84143
Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thun...
 critical 9.8 —Mozilla / firefox 2026-09-012026-09-03
CVE-2026-84133
Site isolation issue in the DOM: Push Subscriptions component.
 critical 9.8 —Mozilla / firefox 2026-09-012026-09-03
CVE-2026-84134
Other issue in the Profile Backup component.
 critical 9.8 —Mozilla / firefox 2026-09-012026-09-03
CVE-2026-84135
Other issue in Firefox Focus for Android.
 critical 9.8 —Mozilla / firefox mobile 2026-09-012026-09-03
CVE-2026-84129
Site isolation issue in the DOM: Navigation component.
 critical 9.8 —Mozilla / firefox 2026-09-012026-09-03
CVE-2026-84119
Sandbox escape due to use-after-free in the DOM: Navigation component.
 critical 9.6 —Mozilla / firefox 2026-09-012026-09-02
CVE-2026-84121
Sandbox escape due to use-after-free in the DOM: Security component.
 critical 9.6 —Mozilla / firefox 2026-09-012026-09-02
CVE-2026-100830
Mitigation bypass in the DOM: Navigation component.
 high 8.1 —Mozilla / firefox 2026-09-292026-10-13
CVE-2026-100831
Use-after-free in the DOM: UI Events & Focus Handling component.
 high 8.8 —Mozilla / firefox 2026-09-292026-10-13
CVE-2026-100832
Use-after-free in the Graphics: Canvas2D component.
 high 8.8 —Mozilla / firefox 2026-09-292026-10-05
CVE-2026-100820
Privilege escalation in the Address Bar component.
 high 8.8 —Mozilla / firefox 2026-09-292026-10-05
CVE-2026-100824
Privilege escalation in the Places component.
 high 8.8 —Mozilla / firefox 2026-09-292026-10-13
CVE-2026-100825
Use-after-free in the JavaScript Engine: JIT component.
 high 8.8 —Mozilla / firefox 2026-09-292026-10-13
CVE-2026-100809
Same-origin policy bypass in the DevTools component.
 high 8.1 —Mozilla / firefox 2026-09-292026-10-05
CVE-2026-100813
Invalid pointer in the JavaScript Engine: JIT component.
 high 8.8 —Mozilla / firefox 2026-09-292026-10-05
CVE-2026-100814
Incorrect boundary conditions in the JavaScript Engine: JIT component.
 high 8.8 —Mozilla / firefox 2026-09-292026-10-05
CVE-2026-100815
Use-after-free in the CSS Parsing and Computation component.
 high 8.8 —Mozilla / firefox 2026-09-292026-10-05
CVE-2026-100816
Site isolation issue in the DOM: Networking component.
 high 8.1 —Mozilla / firefox 2026-09-292026-10-05
CVE-2026-100801
Privilege escalation in the DLL Services component.
 high 8.8 —Mozilla / firefox 2026-09-292026-10-27
CVE-2026-100803
Same-origin policy bypass in the WebExtensions component.
 high 8.1 —Mozilla / firefox 2026-09-292026-10-19
CVE-2026-100805
Race condition, use-after-free in the Audio/Video component.
 high 7.5 —Mozilla / firefox 2026-09-292026-10-19
CVE-2026-100807
Privilege escalation in the DOM: Service Workers component.
 high 8.8 —Mozilla / firefox 2026-09-292026-10-19
CVE-2026-100808
Mitigation bypass in the DOM: Service Workers component.
 high 8.8 —Mozilla / firefox 2026-09-292026-10-05
CVE-2026-100790
Use-after-free in the XSLT component.
 high 8.8 —Mozilla / firefox 2026-09-292026-10-19
CVE-2026-100791
Use-after-free in the DOM: Core & HTML component.
 high 8.8 —Mozilla / firefox 2026-09-292026-10-19
CVE-2026-100792
JIT miscompilation in the JavaScript: WebAssembly component.
 high 7.1 —Mozilla / firefox 2026-09-292026-10-19
CVE-2026-100796
Use-after-free in the JavaScript: WebAssembly component.
 high 8.8 —Mozilla / firefox 2026-09-292026-10-19
CVE-2026-100797
Privilege escalation due to use-after-free in the Graphics: WebRender component.
 high 8.8 —Mozilla / firefox 2026-09-292026-10-19
CVE-2026-100798
Cryptography misuse in Storage: Quota Manager component.
 high 8.1 —Mozilla / firefox 2026-09-292026-10-19
CVE-2026-100782
Privilege escalation due to incorrect boundary conditions in the Graphics compon...
 high 8.8 —Mozilla / firefox 2026-09-292026-10-05
CVE-2026-100784
Use-after-free in the Layout: Text and Fonts component.
 high 8.8 —Mozilla / firefox 2026-09-292026-10-05
CVE-2026-100785
Use-after-free in the DOM: Core & HTML component.
 high 8.8 —Mozilla / firefox 2026-09-292026-10-05
CVE-2026-100789
Use-after-free in the Graphics: Canvas2D component.
 high 8.8 —Mozilla / firefox 2026-09-292026-10-19
CVE-2026-100776
Use-after-free in the JavaScript: WebAssembly component.
 high 8.8 —Mozilla / firefox 2026-09-292026-10-06

Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.