September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-102312 UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.80... |
medium | 4.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102313 Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 154.0.80... |
medium | 4.7 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102314 UI misrepresentation in TabStrip in Google Chrome prior to 154.0.8037.92 allowed... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102303 Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037... |
medium | 4.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102305 UI misrepresentation in SignIn in Google Chrome on on iOS prior to 154.0.8037.92... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102307 Uninitialized resource in Dawn in Google Chrome on on Android prior to 154.0.803... |
medium | 4.7 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-102300 Uninitialized resource in WebGPU in Google Chrome prior to 154.0.8037.92 allowed... |
medium | 4.3 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-100297 In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an unauthenticated network c... |
medium | 5.3 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-100299 In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the device includes a legacy... |
medium | 6.8 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-100295 In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an internal debug interface... |
medium | 6.3 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2024-31027 Cross Site Scripting vulnerability in Greek Universities Network (GUnet) Open eC... |
medium | 5.4 | — | — | 2026-09-29 | 2026-10-27 |
| CVE-2026-102830 JupyterLab is an extensible environment for interactive and reproducible computi... |
medium | 6.8 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102824 Russh is a Rust SSH client and server library. |
medium | 4.3 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102820 pageant provides a [PageantStream] type that implements [AsyncRead] and [AsyncWr... |
medium | 6.2 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102821 Russh is a Rust SSH client and server library. |
medium | 6.5 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-95382 Improper input validation in Auth in Google Chrome prior to 154.0.8037.57 allowe... |
medium | 6.5 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2026-95384 Race condition in Transactions Platform in Google Chrome prior to 154.0.8037.57... |
medium | 5.3 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2026-95385 Inappropriate implementation in PlatformIntegration in Google Chrome on on Windo... |
medium | 6.5 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2026-95371 Missing authorization in Views in Google Chrome on on Mac prior to 154.0.8037.57... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95374 Incorrect authorization in Network in Google Chrome prior to 154.0.8037.57 allow... |
medium | 6.5 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2026-95375 Incorrect authorization in BrowserTag in Google Chrome prior to 154.0.8037.57 al... |
medium | 6.3 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-95364 Improper input validation in Passwords in Google Chrome prior to 154.0.8037.57 a... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-95366 Use of released resource in Core in Google Chrome prior to 154.0.8037.57 allowed... |
medium | 6.5 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-95367 Information leak in DataTransfer in Google Chrome prior to 154.0.8037.57 allowed... |
medium | 5.3 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-95368 Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allo... |
medium | 4.3 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-95370 Inappropriate implementation in NFC in Google Chrome prior to 154.0.8037.57 allo... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-95360 Race condition in Editing in Google Chrome prior to 154.0.8037.57 allowed a remo... |
medium | 5.3 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2026-95361 Confused deputy in DevTools in Google Chrome prior to 154.0.8037.57 allowed a re... |
medium | 4.3 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2026-95363 UI misrepresentation in FileSystem in Google Chrome prior to 154.0.8037.57 allow... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2026-95352 Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allo... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95358 Incorrect authorization in Mobile in Google Chrome on on Android prior to 154.0.... |
medium | 4.4 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-95346 UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allow... |
medium | 4.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95336 Information leak in Transactions Platform in Google Chrome prior to 154.0.8037.5... |
medium | 6.5 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95337 UI misrepresentation in Messages in Google Chrome on on Android prior to 154.0.8... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95340 Incorrect authorization in PictureInPicture in Google Chrome prior to 154.0.8037... |
medium | 4.3 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-95342 Missing authorization in V8 in Google Chrome prior to 154.0.8037.57 allowed a re... |
medium | 4.3 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-95327 Information leak in Networking in Google Chrome prior to 154.0.8037.57 allowed a... |
medium | 6.5 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-95328 Confused deputy in Mobile in Google Chrome on on Android prior to 154.0.8037.57... |
medium | 6.5 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95330 Improper state validation in Downloads in Google Chrome prior to 154.0.8037.57 a... |
medium | 6.5 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-95332 Use of uninitialized variable in Tint in Google Chrome on on Android prior to 15... |
medium | 4.7 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.