September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-41869 Missing Authorization, Improper Resource Shutdown and Job Interruption vulnerabi... |
critical | 9.1 | — | Apache / nutch | 2026-09-09 | 2026-09-10 |
| CVE-2026-41871 Missing Authorization, Use of Externally-Controlled Input to Select Classes or C... |
critical | 9.8 | — | Apache / nutch | 2026-09-09 | 2026-09-10 |
| CVE-2026-56207 Signature of Bearer token is not verified in last step of SAML2 authentication f... |
critical | 9.8 | — | Apache / impala | 2026-09-09 | 2026-09-10 |
| CVE-2026-16272 Use of less trusted source vulnerability in PayTR Payment and Electronic Money I... |
critical | 9.1 | — | — | 2026-09-09 | 2026-10-01 |
| CVE-2026-21095 Heap-based buffer overflow in DNG decoder of libimagecodec.quram.so prior to SMR... |
critical | 9.8 | — | Samsung / android | 2026-09-09 | 2026-09-11 |
| CVE-2026-21096 Heap-based buffer overflow in JPEG decoder of libimagecodec.quram.so prior to SM... |
critical | 9.8 | — | Samsung / android | 2026-09-09 | 2026-09-11 |
| CVE-2026-87646 Use after free in Web Authentication in Google Chrome prior to 153.0.8010.36 all... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87650 Out of bounds read in WebGL in Google Chrome prior to 153.0.8010.36 allowed a re... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87654 Buffer overflow in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 a... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87637 Use after free in Extensions in Google Chrome on on Mac prior to 153.0.8010.36 a... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87638 Out of bounds write in Media in Google Chrome prior to 153.0.8010.36 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87643 Integer overflow in GPU in Google Chrome on on Android prior to 153.0.8010.36 al... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87634 Use after free in WebPackaging in Google Chrome prior to 153.0.8010.36 allowed a... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87621 Out of bounds write in ANGLE in Google Chrome on on Windows prior to 153.0.8010.... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87613 Incorrect reference resolution in Extensions in Google Chrome prior to 153.0.801... |
critical | 9.0 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87607 Use after free in Device in Google Chrome on on Mac prior to 153.0.8010.36 allow... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87609 Use after free in Sharing in Google Chrome on on iOS prior to 153.0.8010.36 allo... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87595 Server-side request forgery in Mobile in Google Chrome prior to 153.0.8010.36 al... |
critical | 9.8 | — | Google / chrome | 2026-09-09 | 2026-09-14 |
| CVE-2026-87581 Use after free in Payments in Google Chrome prior to 153.0.8010.36 allowed a rem... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87558 Use after free in Payments in Google Chrome on on Mac prior to 153.0.8010.36 all... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87547 Incorrect reference resolution in FileSystem in Google Chrome prior to 153.0.801... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87544 Incorrect authorization in Extensions in Google Chrome prior to 153.0.8010.36 al... |
critical | 9.8 | — | Google / chrome | 2026-09-09 | 2026-09-18 |
| CVE-2026-87528 Type confusion in Rust in Google Chrome on on Windows prior to 153.0.8010.36 all... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87529 Numeric truncation error in Media in Google Chrome prior to 153.0.8010.36 allowe... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87534 Missing authorization in WebView in Google Chrome on on Android prior to 153.0.8... |
critical | 9.8 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87520 Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.36 all... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87526 Use after free in Passwords in Google Chrome prior to 153.0.8010.36 allowed a re... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87527 Buffer overflow in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remot... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87512 Use after free in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 al... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87504 Use after free in Core in Google Chrome prior to 153.0.8010.36 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87494 Use after free in Browser in Google Chrome on on Windows prior to 153.0.8010.36... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87500 Improper validation of array index in ANGLE in Google Chrome prior to 153.0.8010... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87488 Use after free in WebGL in Google Chrome on on Android prior to 153.0.8010.36 al... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87492 Incorrect authorization in DevTools in Google Chrome prior to 153.0.8010.36 allo... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87470 Improper quantity validation in Tint in Google Chrome on on Mac prior to 153.0.8... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87474 Use after free in Payments in Google Chrome prior to 153.0.8010.36 allowed a rem... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87464 Use after free in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87448 Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a rem... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87455 Use after free in Aura in Google Chrome prior to 153.0.8010.36 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87438 Out of bounds write in WebGL in Google Chrome on on Android prior to 153.0.8010.... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.