September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87515 Incorrect authorization in FileAPI in Google Chrome prior to 153.0.8010.36 allow... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87516 Observable discrepancy in Navigation in Google Chrome prior to 153.0.8010.36 all... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87518 Observable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 153.0... |
medium | 5.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87501 UI misrepresentation in Passwords in Google Chrome prior to 153.0.8010.36 allowe... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87502 Confused deputy in Fullscreen in Google Chrome prior to 153.0.8010.36 allowed a... |
medium | 4.2 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87503 Inappropriate implementation in Downloads in Google Chrome on on Android prior t... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87507 UI misrepresentation in Downloads in Google Chrome prior to 153.0.8010.36 allowe... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87508 Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowe... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87493 Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allo... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-87495 Information leak in Scroll in Google Chrome prior to 153.0.8010.36 allowed a rem... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87496 UI misrepresentation in Browser in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87497 Uninitialized resource in Codecs in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87484 UI misrepresentation in Geometry in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87486 Clickjacking in TrustedWebActivities in Google Chrome on on Android prior to 153... |
medium | 4.0 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87490 Information leak in Transactions Platform in Google Chrome prior to 153.0.8010.3... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87475 Missing authorization in Omnibox in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87476 Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowe... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87477 Information leak in Core in Google Chrome prior to 153.0.8010.36 allowed a remot... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87478 Observable discrepancy in Autofill in Google Chrome prior to 153.0.8010.36 allow... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87482 Cleartext transmission of sensitive data in HttpsUpgrades in Google Chrome on on... |
medium | 5.9 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87483 Incorrect authorization in Browser in Google Chrome on on Android prior to 153.0... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87465 Incorrect authorization in Downloads in Google Chrome prior to 153.0.8010.36 all... |
medium | 4.2 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87466 Incorrect authorization in Workers in Google Chrome prior to 153.0.8010.36 allow... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87468 Incorrect authorization in Isolated in Google Chrome prior to 153.0.8010.36 allo... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-11 |
| CVE-2026-87469 Improper input validation in Extensions in Google Chrome prior to 153.0.8010.36... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-15 |
| CVE-2026-87472 Improper input validation in FedCM in Google Chrome prior to 153.0.8010.36 allow... |
medium | 4.2 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87473 Incorrect authorization in FileHandling in Google Chrome prior to 153.0.8010.36... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-15 |
| CVE-2026-87458 UI misrepresentation in Geometry in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87459 Observable discrepancy in Select in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87461 Information leak in Core in Google Chrome prior to 153.0.8010.36 allowed a remot... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87462 UI misrepresentation in FedCM in Google Chrome prior to 153.0.8010.36 allowed a... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87463 Incorrect authorization in Certificate in Google Chrome on on Android prior to 1... |
medium | 4.8 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87447 Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allow... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87449 Cross-site request forgery in DeviceBoundSessionCredentials in Google Chrome pri... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87453 Confused deputy in BackgroundFetch in Google Chrome prior to 153.0.8010.36 allow... |
medium | 5.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87454 Information leak in Enterprise in Google Chrome on on Windows prior to 153.0.801... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87439 Information leak in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowe... |
medium | 5.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87441 Missing authorization in Downloads in Google Chrome prior to 153.0.8010.36 allow... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87443 Missing authorization in Actor in Google Chrome prior to 153.0.8010.36 allowed a... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87445 UI misrepresentation in Session in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.