September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87083 A weakness has been identified in tile-ai tilelang up to 0.1.14. |
medium | 5.5 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-87724 Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST wa... |
medium | 6.5 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-87655 Clickjacking in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remo... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87656 Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.3... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-14 |
| CVE-2026-87658 Information leak in Extensions in Google Chrome prior to 153.0.8010.36 allowed a... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87649 UI misrepresentation in Downloads in Google Chrome prior to 153.0.8010.36 allowe... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87651 Incorrect authorization in Paint in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87653 UI misrepresentation in FullScreen in Google Chrome on on Windows prior to 153.0... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87640 Out of bounds read in WebView in Google Chrome on on Android prior to 153.0.8010... |
medium | 6.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87641 Race condition in Browser in Google Chrome prior to 153.0.8010.36 allowed a remo... |
medium | 4.2 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87642 Uninitialized resource in WebGL in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87645 Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.3... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87629 Incorrect authorization in Sources in Google Chrome prior to 153.0.8010.36 allow... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87630 Integer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a rem... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87631 Missing authorization in DOM in Google Chrome prior to 153.0.8010.36 allowed a r... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87632 Cross-site scripting in SanitizerAPI in Google Chrome prior to 153.0.8010.36 all... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87635 UI misrepresentation in Payments in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87619 Observable discrepancy in Prefetch in Google Chrome prior to 153.0.8010.36 allow... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87620 Observable discrepancy in SVG in Google Chrome prior to 153.0.8010.36 allowed a... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87622 Missing authorization in FedCM in Google Chrome prior to 153.0.8010.36 allowed a... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87623 Observable discrepancy in DOM in Google Chrome prior to 153.0.8010.36 allowed a... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87624 UI misrepresentation in Passwords in Google Chrome on on Android prior to 153.0.... |
medium | 4.2 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87626 Incorrect authorization in DeviceBoundSessionCredentials in Google Chrome prior... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-87627 Interpretation conflict in Safebrowsing in Google Chrome on on Mac prior to 153.... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-14 |
| CVE-2026-87610 Incorrect authorization in Omnibox in Google Chrome prior to 153.0.8010.36 allow... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-87615 Race condition in Payments in Google Chrome prior to 153.0.8010.36 allowed a rem... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87600 Improper input validation in Safebrowsing in Google Chrome on on Android prior t... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-87602 Out of bounds read in ANGLE in Google Chrome on on Windows prior to 153.0.8010.3... |
medium | 4.7 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87603 Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allo... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-87605 Missing authorization in Contacts in Google Chrome prior to 153.0.8010.36 allowe... |
medium | 5.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87591 Incorrect authorization in Extensions in Google Chrome prior to 153.0.8010.36 al... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-87592 Out of bounds read in Tint in Google Chrome prior to 153.0.8010.36 allowed a rem... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87593 Information leak in Editing in Google Chrome prior to 153.0.8010.36 allowed a re... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87594 Incorrect authorization in DataTransfer in Google Chrome prior to 153.0.8010.36... |
medium | 5.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87596 Out of bounds read in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a re... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87597 UI misrepresentation in CustomTabs in Google Chrome on on Android prior to 153.0... |
medium | 4.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87598 Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87599 Improper input validation in Interstitials in Google Chrome prior to 153.0.8010.... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87583 UI misrepresentation in Passwords in Google Chrome on on Android prior to 153.0.... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87584 Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.