September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87479 Insufficient policy enforcement in Extensions in Google Chrome prior to 153.0.80... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87480 Use after free in Printing in Google Chrome prior to 153.0.8010.36 allowed a rem... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87481 Incorrect authorization in WebView in Google Chrome on on Android prior to 153.0... |
high | 8.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87467 Race condition in Updater in Google Chrome on on Windows prior to 153.0.8010.36... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87471 Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87457 Race condition in Updater in Google Chrome on on Windows prior to 153.0.8010.36... |
high | 8.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87460 Use after free in Platform in Google Chrome prior to 153.0.8010.36 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87450 Incorrect authorization in Permissions in Google Chrome prior to 153.0.8010.36 a... |
high | 7.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87440 Out of bounds read in Media in Google Chrome prior to 153.0.8010.36 allowed a re... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87444 Memory corruption in Codecs in Google Chrome prior to 153.0.8010.36 allowed a re... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87430 Buffer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remo... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87431 Missing authorization in Extensions in Google Chrome prior to 153.0.8010.36 allo... |
high | 7.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87433 Race condition in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remo... |
high | 8.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-19201 An uncontrolled recursion vulnerability in the Windows SIPA event log parser of... |
high | 7.5 | — | Google / go-attestation | 2026-09-09 | 2026-09-24 |
| CVE-2026-28659 In MicroXR Blobstore, there is a possible way to access other app's files due to... |
high | 7.8 | — | Google / android xr | 2026-09-08 | 2026-10-05 |
| CVE-2026-58846 In kvm_iommu_map_sg of iommu.c, there is a possible use after free due to a miss... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-58848 In multiple functions of alloc.c, there is a possible unauthorized read/write ac... |
high | 7.0 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-58874 In multiple functions of SmsController.java, there is a possible escalation of p... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-58941 In multiple functions of iommu.c, there is a possible out of bounds read/write d... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-58820 In multiple locations, there is a possible memory safety issue due to integer ov... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-58823 In stpropnci_process_std of stpropnci_std.cc, there is a possible memory safety... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-58839 In forEachLine of MountRegistry.cpp, there is a possible out of bounds read due... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-55273 In AppendCommentLine of AnnotationProcessor.cpp, there is a possible supply chai... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-25 |
| CVE-2026-55277 In checkUiccListenConfigNeeded of RoutingManager.cpp, there is a possible out of... |
high | 8.0 | — | Google / android | 2026-09-08 | 2026-09-25 |
| CVE-2026-55285 In openLogicalChannel of multiple files, there is a possible out-of-bounds write... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-25 |
| CVE-2026-55294 In ihevcd_get_tu_data_size of ihevcd_utils.c, there is a possible out of bounds... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-49918 In multiple functions, there is a possible out of bounds write due to an integer... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-49919 In tt_face_colr_blend_layer of ttcolr.c, there is a possible remote code executi... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-49927 In multiple locations, there is a possible out of bounds write due to an integer... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-49932 In parseParts of PduParser.java, there is a possible out of bounds read due to a... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-45528 In getManageSpaceActivityIntent of StorageManagerService.java, there is a possib... |
high | 7.3 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-45531 In read_boot_region of fsck.c, there is a possible out of bounds read due to a h... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-23 |
| CVE-2026-49879 In multiple functions of rw_t3t.cc, there is a possible out of bounds write due... |
high | 8.8 | — | Google / android | 2026-09-08 | 2026-09-23 |
| CVE-2026-49881 In serviceClassExists of InCallController.java, there is a possible arbitrary co... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-23 |
| CVE-2026-49882 In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible memory safety issue d... |
high | 8.8 | — | Google / android | 2026-09-08 | 2026-09-23 |
| CVE-2026-49884 In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write d... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-23 |
| CVE-2026-49887 In maybeRemoveInvalidInstallerPackageName of InstallRepository.kt, there is a po... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-23 |
| CVE-2026-45515 In a2dp_vendor_opus_decoder_decode_packet of a2dp_vendor_opus_decoder.cc, there... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-45520 In onAttach of BiometricsSettingsBase.java, there is a possible authentication b... |
high | 7.8 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-28656 In multiple functions of DeviceAdminAdd.java, there is a possible way to an over... |
high | 7.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.