September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100777 Use-after-free in the Graphics: Canvas2D component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100779 Use-after-free in the XSLT component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100780 Use-after-free in the DOM: Core & HTML component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100768 Use-after-free in the Graphics: WebGPU component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-06 |
| CVE-2026-100769 Use-after-free in the JavaScript: WebAssembly component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-06 |
| CVE-2026-100771 Undefined behavior in the DOM: Streams component. |
high | 8.1 | — | Mozilla / firefox | 2026-09-29 | 2026-10-06 |
| CVE-2026-100772 Use-after-free in the DOM: Core & HTML component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-06 |
| CVE-2026-100773 Use-after-free in the Storage: IndexedDB component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-06 |
| CVE-2026-100774 Use-after-free in the DOM: Core & HTML component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-06 |
| CVE-2026-100757 Use-after-free in the Widget component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100759 Uninitialized memory in the Storage: Quota Manager component. |
high | 8.1 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100761 Privilege escalation due to use-after-free in the Graphics: WebGPU component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100764 Privilege escalation due to incorrect boundary conditions in the Graphics: WebGP... |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100765 Use-after-free in the JavaScript: WebAssembly component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100767 Use-after-free in the Networking: Cache component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-06 |
| CVE-2026-100756 Incorrect boundary conditions in the Audio/Video: Playback component. |
high | 8.1 | — | Mozilla / firefox | 2026-09-29 | 2026-10-06 |
| CVE-2026-92239 A maliciously constructed IMAP line could cause an out-of-bounds buffer read. |
high | 8.1 | — | Mozilla / thunderbird | 2026-09-15 | 2026-09-24 |
| CVE-2026-92076 Incorrect boundary conditions in the Networking component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92072 Incorrect boundary conditions in the Safe Browsing component. |
high | 8.0 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92073 Privilege escalation in the Enterprise Policies component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92074 Mitigation bypass in the Popup Blocker component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92064 Sandbox escape due to incorrect boundary conditions in the Widget: Win32 compone... |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92065 Sandbox escape due to incorrect boundary conditions in the Widget: Win32 compone... |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92067 Use-after-free in the Widget: Gtk component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92058 Use-after-free in the Graphics component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92060 Use-after-free in the Internationalization component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92062 Privilege escalation in the Session Restore component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92055 Privilege escalation in the DevTools component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92056 Use-after-free in the Graphics: Text component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92054 Privilege escalation in the Memory component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92053 Privilege escalation in the Graphics: CanvasWebGL component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92046 Use-after-free in the Graphics component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92047 Privilege escalation in the Crash Reporting component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92049 Use-after-free in the Widget: Win32 component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92052 Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL co... |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92040 Use-after-free in the JavaScript: WebAssembly component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92042 Race condition in the DOM: Content Processes component. |
high | 7.5 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92043 Privilege escalation due to incorrect boundary conditions in the Audio/Video com... |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92044 Information disclosure in the Networking: HTTP component. |
high | 7.5 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92029 Use-after-free in the SVG component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.