September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-95304 Out of bounds write in V8 in Google Chrome prior to 154.0.8037.57 allowed a remo... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95306 Type confusion in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95298 Use after free in Browser in Google Chrome prior to 154.0.8037.57 allowed a loca... |
high | 7.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95285 Missing authorization in WebView in Google Chrome on on Android prior to 154.0.8... |
high | 8.4 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2026-95286 Type confusion in Bindings in Google Chrome prior to 154.0.8037.57 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95278 Missing authorization in WakeLock in Google Chrome prior to 154.0.8037.57 allowe... |
high | 8.4 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2026-95280 Race condition in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote at... |
high | 7.5 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95282 Use after free in Platform in Google Chrome prior to 154.0.8037.57 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95274 Improper output encoding in DevTools in Google Chrome prior to 154.0.8037.57 all... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95276 Improper input validation in Themes in Google Chrome prior to 154.0.8037.57 allo... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-93377 Type confusion in V8 in Google Chrome prior to 153.0.8010.52 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-93381 Buffer overflow in PDFium in Google Chrome on on Windows prior to 153.0.8010.52... |
high | 8.8 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-93382 Use after free in PDFium in Google Chrome prior to 153.0.8010.52 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-09-17 | 2026-09-19 |
| CVE-2026-93375 Incorrect reference resolution in Tracing in Google Chrome on on Windows prior t... |
high | 8.1 | — | Google / chrome | 2026-09-17 | 2026-09-21 |
| CVE-2026-91743 Race condition in Core in Google Chrome prior to 153.0.8010.47 allowed a remote... |
high | 8.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91745 Use after free in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91748 Race condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 a... |
high | 8.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91735 Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.47 allowed... |
high | 8.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91736 Use after free in DOM in Google Chrome prior to 153.0.8010.47 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91737 Use after free in PDF in Google Chrome prior to 153.0.8010.47 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91741 Type confusion in CacheStorage in Google Chrome prior to 153.0.8010.47 allowed a... |
high | 8.8 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91731 Type confusion in Compositing in Google Chrome prior to 153.0.8010.47 allowed a... |
high | 8.8 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91732 Missing authorization in AppManifest in Google Chrome prior to 153.0.8010.47 all... |
high | 8.1 | — | Google / chrome | 2026-09-15 | 2026-09-18 |
| CVE-2026-91733 Improper state validation in Skia in Google Chrome prior to 153.0.8010.47 allowe... |
high | 8.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91734 Incorrect authorization in Core in Google Chrome on on Windows prior to 153.0.80... |
high | 7.4 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91721 Use after free in Internals in Google Chrome prior to 153.0.8010.47 allowed a re... |
high | 8.8 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91722 Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91724 Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote... |
high | 8.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91727 Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to... |
high | 8.1 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91712 Race condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 a... |
high | 8.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91715 Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed... |
high | 8.8 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91719 Code injection in XML in Google Chrome prior to 153.0.8010.47 allowed a remote a... |
high | 8.1 | — | Google / chrome | 2026-09-15 | 2026-09-18 |
| CVE-2026-91709 Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed... |
high | 8.8 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91711 Out of bounds write in ServiceWorker in Google Chrome prior to 153.0.8010.47 all... |
high | 8.8 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-58728 In ARM64_TLBI of mmu.h, there is a possible memory corruption due to a race cond... |
high | 7.0 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58734 In google_mba_recv_msg of google_mba_poll.c, there is a possible out-of-bounds w... |
high | 7.0 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58744 In multiple locations, there is a possible escalation of privilege due to improp... |
high | 7.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58766 In multiple functions of arm-smmu-v3.c, there is a possible escalation of privil... |
high | 7.8 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58699 In Vp9DecEndOfStream of vp9hwd_output.cc, there is a possible out-of-bounds read... |
high | 8.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58701 In trusty_dputc of generic-arm64-smcall.c, there is a possible out-of-bounds wri... |
high | 7.0 | — | Google / android | 2026-09-15 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.