September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92054 Privilege escalation in the Memory component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92053 Privilege escalation in the Graphics: CanvasWebGL component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92046 Use-after-free in the Graphics component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92047 Privilege escalation in the Crash Reporting component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92049 Use-after-free in the Widget: Win32 component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92052 Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL co... |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92040 Use-after-free in the JavaScript: WebAssembly component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92042 Race condition in the DOM: Content Processes component. |
high | 7.5 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92043 Privilege escalation due to incorrect boundary conditions in the Audio/Video com... |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92044 Information disclosure in the Networking: HTTP component. |
high | 7.5 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92029 Use-after-free in the SVG component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92033 Privilege escalation in Firefox for Android. |
high | 8.8 | — | Mozilla / firefox mobile | 2026-09-15 | 2026-10-05 |
| CVE-2026-92026 Use-after-free in the Networking component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92027 Use-after-free in the DOM: Streams component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92028 Use-after-free in the DOM: Core & HTML component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92021 Use-after-free in the JavaScript Engine: JIT component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92022 Use-after-free in the DOM: HTML Parser component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92023 Use-after-free in the XML component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92024 Use-after-free in the SVG component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92025 Use-after-free in the DOM: Navigation component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92015 Privilege escalation in the WebExtensions component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92016 Use-after-free in the Disability Access APIs component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92017 Privilege escalation in the DOM: Service Workers component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92019 Mitigation bypass in the Remote Settings Client component. |
high | 8.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92020 Privilege escalation due to incorrect boundary conditions in the Graphics: WebRe... |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92014 Privilege escalation due to incorrect boundary conditions in the Graphics compon... |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92011 Privilege escalation due to incorrect boundary conditions in the Graphics: Canva... |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92012 Privilege escalation due to incorrect boundary conditions in the Graphics: Canva... |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92013 Privilege escalation due to incorrect boundary conditions in the Graphics: Canva... |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92006 Privilege escalation due to incorrect boundary conditions in the Graphics: Canva... |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92007 Privilege escalation due to incorrect boundary conditions in the Graphics: Canva... |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92008 Privilege escalation due to incorrect boundary conditions in the Graphics: Canva... |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92009 Privilege escalation due to incorrect boundary conditions in the Graphics: Canva... |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92010 Privilege escalation due to incorrect boundary conditions in the Graphics: Canva... |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-14805 The Consulting theme for WordPress is vulnerable to Privilege Escalation in vers... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-91996 lamp-cloud through 5.10.0 whitelists the path pattern /*/anno/** for anonymous a... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-91924 pgweb through 0.17.0 leaves the POST /api/connect endpoint unguarded when connec... |
high | 8.5 | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-91925 Polyaxon through 2.16.4 renders operation specification fields with an unsandbox... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-91923 KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in... |
high | 7.7 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-57137 PraisonAI is a multi-agent teams system. |
high | 8.8 | — | — | 2026-09-15 | 2026-09-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.