September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86776 KeePass versions 2.35 through 2.61.1 fail to validate KDBX header field sizes be... |
low | 3.3 | — | — | 2026-09-09 | 2026-09-10 |
| CVE-2026-80175 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
low | 3.3 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-14 |
| CVE-2026-13144 The WP Travel WordPress plugin before 12.0.2 does not properly verify that the r... |
low | 3.7 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-13146 The WP Travel WordPress plugin before 12.0.2 does not properly verify that the r... |
low | 3.7 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-87657 Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote at... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87647 Uninitialized resource in GPU in Google Chrome prior to 153.0.8010.36 allowed a... |
low | 3.4 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87652 Incorrect authorization in PushAPI in Google Chrome prior to 153.0.8010.36 allow... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87611 Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allo... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87614 Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87576 Uninitialized resource in GPU in Google Chrome on on Android prior to 153.0.8010... |
low | 3.4 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87539 Observable discrepancy in Network in Google Chrome prior to 153.0.8010.36 allowe... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87531 Information leak in CORS in Google Chrome prior to 153.0.8010.36 allowed a remot... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87521 Information leak in WebMCP in Google Chrome prior to 153.0.8010.36 allowed a rem... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87525 Out of bounds read in Chromoting in Google Chrome on on Windows prior to 153.0.8... |
low | 2.7 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87517 Race condition in Mobile in Google Chrome on on iOS prior to 153.0.8010.36 allow... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87498 Missing authorization in WebUI in Google Chrome prior to 153.0.8010.36 allowed a... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87485 Incorrect authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87451 Information leak in Downloads in Google Chrome prior to 153.0.8010.36 allowed a... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87452 Incorrect authorization in GPU in Google Chrome on on Mac prior to 153.0.8010.36... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87456 Uninitialized resource in Media in Google Chrome prior to 153.0.8010.36 allowed... |
low | 3.4 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87442 Confused deputy in Prerender in Google Chrome prior to 153.0.8010.36 allowed a r... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87434 Missing authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a... |
low | 3.1 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-86564 A flaw was found in DPDK lib/vhost. |
low | 3.3 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-75726 Adobe Experience Manager is affected by an Improper Input Validation vulnerabili... |
low | 3.5 | — | Adobe / experience manager | 2026-09-08 | 2026-09-10 |
| CVE-2026-55290 In setTo of ResourceTypes.cpp, there is a possible out-of-bounds heap read due t... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-49895 In get_eht_operation_channel_width of ieee802_11_common.c, there is a possible o... |
low | 3.5 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-28671 In updateInternal of MediaProvider.java, there is a possible expose contents of... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-23 |
| CVE-2026-45519 In screenArgsForPermissionCheckIfAny of multiple locations there is a possible r... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-45521 In openFile of AppFuseBridge.java, there is a possible information disclosure du... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-45525 In multiple locations, there is a possible improper data sanitization due to a l... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-24 |
| CVE-2026-28660 In getAllSessions of multiple files, there is a possible confused deputy due to... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28638 In multiple functions of XmpDataParser.java, there is a possible improper data s... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28652 In multiple functions of RangingServiceImpl.java, there is a possible MITM due t... |
low | 3.1 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28622 In getQueryBuilderInternal of MediaProvider.java, there is a possible way to ret... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28623 In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28630 In onCreate of ContactsPickerActivity.kt, there is a possible misleading UI due... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-28582 In onCreate of ConfirmDeviceCredentialActivity.java, there is a possible unautho... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-0054 In isCallerAllowed of WalletContextualLocationsService.kt, there is a possible w... |
low | 3.3 | — | Google / android | 2026-09-08 | 2026-09-15 |
| CVE-2026-9216 An insufficient input validation vulnerability in the listed NETGEAR RAX series... |
low | 3.5 | — | Netgear / rax30 firmware | 2026-09-08 | 2026-10-13 |
| CVE-2026-86670 A flaw has been found in aircheng-org iWebShop-5 up to 5.15. |
low | 3.7 | — | — | 2026-09-08 | 2026-09-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.