September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100812 Denial-of-service in the Graphics component. |
medium | 6.5 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100817 Other issue in the JavaScript: WebAssembly component. |
medium | 5.4 | — | Mozilla / firefox | 2026-09-29 | 2026-10-06 |
| CVE-2026-100802 Uninitialized memory in the Graphics: WebGPU component. |
medium | 4.3 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100806 Uninitialized memory in the Graphics: WebGPU component. |
medium | 4.3 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100793 JIT miscompilation in the JavaScript Engine component. |
medium | 6.5 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100795 Denial-of-service in the Networking component. |
medium | 6.5 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100799 Uninitialized memory in the Graphics: WebGPU component. |
medium | 4.3 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100783 Uninitialized memory in the Audio/Video component. |
medium | 4.3 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100766 Information disclosure in the Networking: JAR component. |
medium | 4.3 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-92077 Denial-of-service in the SVG component. |
medium | 6.5 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92078 Denial-of-service in the Security component. |
medium | 6.5 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92068 Site isolation issue in the Reader Mode component. |
medium | 5.4 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92069 Spoofing issue in the DOM: Navigation component. |
medium | 5.4 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92070 Information disclosure in the Networking component. |
medium | 4.3 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92063 Denial-of-service in the Audio/Video component. |
medium | 6.5 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92039 Mitigation bypass in the DOM: Notifications component. |
medium | 6.3 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92030 Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. |
medium | 5.4 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92031 Information disclosure in the Graphics: ImageLib component. |
medium | 6.5 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92005 Use-after-free in the Audio/Video: Web Codecs component. |
medium | 5.3 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-86853 A malicious webpage could repeatedly trigger external URL schemes, causing syste... |
medium | 4.3 | — | Mozilla / firefox mobile | 2026-09-08 | 2026-10-05 |
| CVE-2026-84139 Clickjacking issue in the DOM: Events component. |
medium | 6.1 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84136 Other issue in the DOM: Navigation component. |
medium | 6.1 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84137 Spoofing issue in the DOM: Core & HTML component. |
medium | 4.3 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84138 Denial-of-service in the PDF Viewer component. |
medium | 6.5 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84122 Use-after-free in the Audio/Video component. |
medium | 5.4 | — | Mozilla / firefox | 2026-09-01 | 2026-09-02 |
| CVE-2026-84124 Use-after-free in the DOM: Core & HTML component. |
medium | 5.4 | — | Mozilla / firefox | 2026-09-01 | 2026-09-02 |
| CVE-2026-84125 Use-after-free in the DOM: Core & HTML component. |
medium | 5.4 | — | Mozilla / firefox | 2026-09-01 | 2026-09-02 |
| CVE-2026-84126 Incorrect boundary conditions in the Layout: Grid component. |
medium | 4.3 | — | Mozilla / firefox | 2026-09-01 | 2026-09-03 |
| CVE-2026-84127 Information disclosure in the WebExtensions component in Firefox for Android. |
medium | 4.3 | — | Mozilla / firefox mobile | 2026-09-01 | 2026-09-03 |
| CVE-2026-84118 Use-after-free in the JavaScript: GC component. |
medium | 5.4 | — | Mozilla / firefox | 2026-09-01 | 2026-09-02 |
| CVE-2026-84120 Use-after-free in the Audio/Video component. |
medium | 5.4 | — | Mozilla / firefox | 2026-09-01 | 2026-09-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.