September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92033 Privilege escalation in Firefox for Android. |
high | 8.8 | — | Mozilla / firefox mobile | 2026-09-15 | 2026-10-05 |
| CVE-2026-92026 Use-after-free in the Networking component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92027 Use-after-free in the DOM: Streams component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92028 Use-after-free in the DOM: Core & HTML component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92021 Use-after-free in the JavaScript Engine: JIT component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92022 Use-after-free in the DOM: HTML Parser component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92023 Use-after-free in the XML component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92024 Use-after-free in the SVG component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92025 Use-after-free in the DOM: Navigation component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92015 Privilege escalation in the WebExtensions component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92016 Use-after-free in the Disability Access APIs component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92017 Privilege escalation in the DOM: Service Workers component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92019 Mitigation bypass in the Remote Settings Client component. |
high | 8.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92020 Privilege escalation due to incorrect boundary conditions in the Graphics: WebRe... |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92014 Privilege escalation due to incorrect boundary conditions in the Graphics compon... |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92011 Privilege escalation due to incorrect boundary conditions in the Graphics: Canva... |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92012 Privilege escalation due to incorrect boundary conditions in the Graphics: Canva... |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92013 Privilege escalation due to incorrect boundary conditions in the Graphics: Canva... |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92006 Privilege escalation due to incorrect boundary conditions in the Graphics: Canva... |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92007 Privilege escalation due to incorrect boundary conditions in the Graphics: Canva... |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92008 Privilege escalation due to incorrect boundary conditions in the Graphics: Canva... |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92009 Privilege escalation due to incorrect boundary conditions in the Graphics: Canva... |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92010 Privilege escalation due to incorrect boundary conditions in the Graphics: Canva... |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-84642 The values of the mail.allowed_attachment_hostnames advanced config setting were... |
high | 7.5 | — | Mozilla / thunderbird | 2026-09-01 | 2026-09-03 |
| CVE-2026-84640 A maliciously constructed mail header could lead to a one byte read past the end... |
high | 7.5 | — | Mozilla / thunderbird | 2026-09-01 | 2026-09-03 |
| CVE-2026-84641 A malicious IMAP server can trigger use-after-free and heap-memory disclosure by... |
high | 7.5 | — | Mozilla / thunderbird | 2026-09-01 | 2026-09-03 |
| CVE-2026-84144 Internally found bugs present in Thunderbird 154 and Thunderbird ESR 153.1. |
high | 7.5 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84145 Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thun... |
high | 7.5 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84130 Information disclosure in the Graphics: WebGPU component. |
high | 7.5 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84131 Privilege escalation due to invalid pointer in the Graphics component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84132 Information disclosure in the Networking: HTTP component. |
high | 7.5 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84123 Privilege escalation due to use-after-free in the Graphics: WebGPU component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-01 | 2026-09-02 |
| CVE-2026-84128 Privilege escalation in the WebDriver BiDi component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84117 Privilege escalation in Firefox for Android. |
high | 8.8 | — | Mozilla / firefox mobile | 2026-09-01 | 2026-09-03 |
| CVE-2026-103500 An attacker could cause a heap buffer overflow by getting a user to open an emai... |
medium | 6.1 | — | Mozilla / thunderbird | 2026-09-30 | 2026-10-16 |
| CVE-2026-96869 Information disclosure in the Networking component. |
medium | 4.3 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100821 Site isolation issue in the Panning and Zooming component. |
medium | 4.7 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100822 Spoofing issue in the Networking: HTTP component. |
medium | 5.4 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100823 Spoofing issue in the Downloads component in Firefox for Android. |
medium | 5.4 | — | Mozilla / firefox mobile | 2026-09-29 | 2026-10-05 |
| CVE-2026-100826 Denial-of-service in the Storage: StorageManager component. |
medium | 6.5 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.