September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-85051 Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a... |
high | 8.8 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-85048 Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a... |
high | 8.3 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-85049 Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-85045 Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote at... |
high | 7.5 | — | Google / chrome | 2026-09-03 | 2026-09-08 |
| CVE-2026-84334 Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 15... |
high | 8.1 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84335 Incorrect authorization in TabStrip in Google Chrome prior to 152.0.7977.75 allo... |
high | 8.3 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84347 Use after free in WebRTC in Google Chrome prior to 152.0.7977.75 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84349 Use after free in Browser in Google Chrome prior to 152.0.7977.75 allowed a remo... |
high | 8.3 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84350 Use after free in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84351 Buffer overflow in GPU in Google Chrome on on Windows prior to 152.0.7977.75 all... |
high | 8.3 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-84326 Uninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a r... |
high | 8.8 | — | Google / chrome | 2026-09-02 | 2026-09-03 |
| CVE-2026-102329 Cross-site scripting in WebUI in Google Chrome prior to 154.0.8037.92 allowed a... |
medium | 6.1 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102330 Incorrect authorization in SiteIsolation in Google Chrome prior to 154.0.8037.92... |
medium | 6.5 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102318 Out of bounds read in WebGL in Google Chrome prior to 154.0.8037.92 allowed a re... |
medium | 4.7 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102320 Missing authorization in CORS in Google Chrome prior to 154.0.8037.92 allowed a... |
medium | 6.5 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102325 Uninitialized resource in Skia in Google Chrome prior to 154.0.8037.92 allowed a... |
medium | 4.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102310 Missing authorization in Payments in Google Chrome prior to 154.0.8037.92 allowe... |
medium | 6.5 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102312 UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.80... |
medium | 4.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102313 Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 154.0.80... |
medium | 4.7 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102314 UI misrepresentation in TabStrip in Google Chrome prior to 154.0.8037.92 allowed... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102303 Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037... |
medium | 4.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102305 UI misrepresentation in SignIn in Google Chrome on on iOS prior to 154.0.8037.92... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102307 Uninitialized resource in Dawn in Google Chrome on on Android prior to 154.0.803... |
medium | 4.7 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102300 Uninitialized resource in WebGPU in Google Chrome prior to 154.0.8037.92 allowed... |
medium | 4.3 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-95382 Improper input validation in Auth in Google Chrome prior to 154.0.8037.57 allowe... |
medium | 6.5 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2026-95384 Race condition in Transactions Platform in Google Chrome prior to 154.0.8037.57... |
medium | 5.3 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2026-95385 Inappropriate implementation in PlatformIntegration in Google Chrome on on Windo... |
medium | 6.5 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2026-95371 Missing authorization in Views in Google Chrome on on Mac prior to 154.0.8037.57... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95374 Incorrect authorization in Network in Google Chrome prior to 154.0.8037.57 allow... |
medium | 6.5 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2026-95375 Incorrect authorization in BrowserTag in Google Chrome prior to 154.0.8037.57 al... |
medium | 6.3 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-95364 Improper input validation in Passwords in Google Chrome prior to 154.0.8037.57 a... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-95366 Use of released resource in Core in Google Chrome prior to 154.0.8037.57 allowed... |
medium | 6.5 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-95367 Information leak in DataTransfer in Google Chrome prior to 154.0.8037.57 allowed... |
medium | 5.3 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-95368 Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allo... |
medium | 4.3 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-95370 Inappropriate implementation in NFC in Google Chrome prior to 154.0.8037.57 allo... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-95360 Race condition in Editing in Google Chrome prior to 154.0.8037.57 allowed a remo... |
medium | 5.3 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2026-95361 Confused deputy in DevTools in Google Chrome prior to 154.0.8037.57 allowed a re... |
medium | 4.3 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2026-95363 UI misrepresentation in FileSystem in Google Chrome prior to 154.0.8037.57 allow... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2026-95352 Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allo... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95358 Incorrect authorization in Mobile in Google Chrome on on Android prior to 154.0.... |
medium | 4.4 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.