September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87648 Use after free in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 al... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87639 Use after free in WebPackaging in Google Chrome prior to 153.0.8010.36 allowed a... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87644 Incorrect authorization in Views in Google Chrome on on Windows prior to 153.0.8... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87628 Use after free in Cast in Google Chrome prior to 153.0.8010.36 allowed an adjace... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87633 Use after free in Views in Google Chrome prior to 153.0.8010.36 allowed a local... |
high | 8.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87636 Type confusion in XML in Google Chrome prior to 153.0.8010.36 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87625 Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87612 Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87616 Improper initialization in Views in Google Chrome on on Windows prior to 153.0.8... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87617 Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87618 Incorrect reference resolution in Storage in Google Chrome on on Windows prior t... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87601 Race condition in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote at... |
high | 7.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87604 Out of bounds read in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a re... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87606 Missing authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36 a... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-87608 Improper certificate validation in FedCM in Google Chrome prior to 153.0.8010.36... |
high | 7.5 | — | Google / chrome | 2026-09-09 | 2026-09-14 |
| CVE-2026-87582 Confused deputy in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87585 Double free in PDFium in Google Chrome on on Windows prior to 153.0.8010.36 allo... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87587 Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87588 Use after free in Chromecast in Google Chrome prior to 153.0.8010.36 allowed a r... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87578 Use after free in Receiver in Google Chrome prior to 153.0.8010.36 allowed an ad... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87579 Buffer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remo... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87569 Missing authorization in Views in Google Chrome prior to 153.0.8010.36 allowed a... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87570 Incorrect authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87572 Injection in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote a... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87554 Race condition in Chromoting in Google Chrome on on Windows prior to 153.0.8010.... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87553 Improper input validation in SiteIsolation in Google Chrome prior to 153.0.8010.... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87536 Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87537 Missing authorization in Extensions in Google Chrome prior to 153.0.8010.36 allo... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87542 Use after free in Input in Google Chrome prior to 153.0.8010.36 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87530 Uncontrolled search path element in CredentialProvider in Google Chrome on on Wi... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87533 Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a loc... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87524 Use after free in Core in Google Chrome on on Windows prior to 153.0.8010.36 all... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87510 Improper input validation in FileAPI in Google Chrome prior to 153.0.8010.36 all... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87514 Use after free in Views in Google Chrome prior to 153.0.8010.36 allowed a local... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87505 Incorrect authorization in FileSystem in Google Chrome prior to 153.0.8010.36 al... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87506 Privilege elevation in WebUI in Google Chrome prior to 153.0.8010.36 allowed a r... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87509 Incorrect authorization in Updater in Google Chrome on on Windows prior to 153.0... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87499 Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allow... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87487 Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allo... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87489 Memory corruption in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.