September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,833
Low
527
Severity not reported
2,537
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-58726 In FsmReleaseKey of fsm.c, there is a possible permission bypass due to a missin... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-58698 In ap_pmic_poll_msg_handler of ap_pmic_ipc.c, there is a possible permission byp... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56988 In multiple functions of bluetooth_cco.cc, there is a possible use-after-free du... |
medium | 6.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56989 In multiple locations, there is a possible out-of-bounds write due to a missing... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56992 In multiple files, there is a possible permission bypass due to a confused deput... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-57006 In acfw_ffa.c, there is a possible secret read due to a logic error in the code. |
medium | 4.4 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-57035 In multiple locations, there is a possible out-of-bounds write due to a missing... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-57042 In multiple functions of DreamPickerReceiver.kt, there is a possible permission... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56972 In multiple locations, there is a possible out-of-bounds write due to an incorre... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56973 In multiple locations, there is a possible escalation of privilege due to a logi... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56975 In Cellular Modem, there is a possible denial of service due to improper input v... |
medium | 6.5 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56979 In multiple locations, there is a possible permission bypass due to a logic erro... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-18 |
| CVE-2026-56923 In handle_unmap_req of tipc_virtio_dev.c, there is a possible memory corruption... |
medium | 6.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56932 In Trusted Execution Environment, there is a possible memory corruption due to i... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56950 In validate_ns_buf of mbu_class.rs, there is a possible information disclosure d... |
medium | 4.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56958 In gf_algo_get_cached_dump_data of gf_algo.c, there is a possible out-of-bounds... |
medium | 5.5 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56964 In multiple locations, there is a possible use-after-free due to a race conditio... |
medium | 6.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56922 In CPM, there is a possible permission bypass due to a confused deputy. |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56915 In bigo_worker_thread of bigo.c, there is a possible escalation of privilege due... |
medium | 6.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56888 In multiple locations, there is a possible permission bypass due to side channel... |
medium | 6.2 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56889 In multiple locations, there is a possible permission bypass due to an integer o... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56892 In ReadDataElement of common.c, there is a possible information disclosure due t... |
medium | 6.2 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56907 In VPU, there is a possible shared memory overwrite due to improper input valida... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-56879 In gmc_mb_msg_handler of gmc_mba.c, there is a possible memory corruption due to... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55365 In multiple functions of remap.c, there is a possible out-of-bounds write due to... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55317 In printf of printf.c, there is a possible out-of-bounds write due to improper i... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55332 In multiple locations, there is a possible out-of-bounds write due to improper i... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55302 In multiple locations, there is a possible permission bypass due to a logic erro... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-55304 In addr_remap_address_map of remap.c, there is a possible escalation of privileg... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-19504 Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability. |
medium | 4.0 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-19641 On affected platforms running Arista EOS with password authentication configured... |
medium | 5.3 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-0177 In do_sss_aes_gcm_256_op of crypto-aes.c, there is a possible out-of-bounds read... |
medium | 4.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0179 In Bootloader, there is a possible permission bypass due to a missing permission... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0183 In CPM, there is a possible information disclosure due to a confused deputy. |
medium | 4.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0186 In ac_init_one_sswrp of init.c, there is a possible escalation of privilege due... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0187 In gsa_sw_pk_hash_compare of image-auth-srv.c, there is a possible escalation of... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0192 In Bootloader, there is a possible escalation of privilege due to a missing perm... |
medium | 6.7 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-0197 In VPU, there is a possible information dislclosure due to a logic error in the... |
medium | 4.4 | — | Google / android | 2026-09-15 | 2026-09-21 |
| CVE-2026-82837 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.... |
medium | 4.3 | — | Gitlab / gitlab | 2026-09-15 | 2026-09-28 |
| CVE-2026-81235 Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain a Missing Cr... |
medium | 4.9 | — | Dell / wyse management suite | 2026-09-15 | 2026-09-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.