September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100294 In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the firmware embeds hardcode... |
high | 7.5 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-102831 JupyterLab is an extensible environment for interactive and reproducible computi... |
high | 8.1 | — | — | 2026-09-29 | 2026-10-02 |
| CVE-2026-102823 Russh is a Rust SSH client and server library. |
high | 7.5 | — | — | 2026-09-29 | 2026-10-02 |
| CVE-2026-102826 simple-git, an interface for running git commands in any node.js application, en... |
high | 8.1 | — | Simple-git Project / simple-git | 2026-09-29 | 2026-10-08 |
| CVE-2026-102616 A vulnerability was detected in risesoft-y9 WorkFlow-Engine up to 9.6.10. |
high | 7.3 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-95372 Use after free in Chromecast in Google Chrome prior to 154.0.8037.57 allowed a r... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2026-95373 Use after free in DevTools in Google Chrome prior to 154.0.8037.57 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2026-95376 Externally controlled reference in DevTools in Google Chrome prior to 154.0.8037... |
high | 8.0 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-95380 Type confusion in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2026-95381 Improper input validation in Printing in Google Chrome prior to 154.0.8037.57 al... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2026-95365 Type confusion in IndexedDB in Google Chrome prior to 154.0.8037.57 allowed a re... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-95369 Inappropriate implementation in XML in Google Chrome prior to 154.0.8037.57 allo... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-95362 Cross-site request forgery in DevTools in Google Chrome prior to 154.0.8037.57 a... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-95351 Use after free in Views in Google Chrome prior to 154.0.8037.57 allowed a remote... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95353 Use after free in Bindings in Google Chrome prior to 154.0.8037.57 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95354 Use after free in Verifier in Google Chrome prior to 154.0.8037.57 allowed a rem... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95355 Incorrect authorization in Navigation in Google Chrome on on iOS prior to 154.0.... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95343 Use after free in WebAudio in Google Chrome prior to 154.0.8037.57 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95344 Race condition in DevTools in Google Chrome prior to 154.0.8037.57 allowed a rem... |
high | 8.0 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-95345 Use after free in Actor in Google Chrome prior to 154.0.8037.57 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95348 Use after free in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed a re... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95335 Use after free in HID in Google Chrome prior to 154.0.8037.57 allowed a remote a... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95338 Use after free in PDFium in Google Chrome prior to 154.0.8037.57 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95341 Improper input validation in Desktop in Google Chrome prior to 154.0.8037.57 all... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95333 Use after free in Metrics in Google Chrome prior to 154.0.8037.57 allowed a remo... |
high | 8.1 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95334 Incorrect reference resolution in WebProtect in Google Chrome prior to 154.0.803... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95319 Use after free in Printing in Google Chrome prior to 154.0.8037.57 allowed a rem... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95322 Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95326 Incomplete cleanup in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed... |
high | 8.4 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2026-95314 Incorrect authorization in HID in Google Chrome prior to 154.0.8037.57 allowed a... |
high | 8.1 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2026-95315 Use after free in Aura in Google Chrome prior to 154.0.8037.57 allowed a local a... |
high | 7.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95301 Missing authorization in Extensions in Google Chrome prior to 154.0.8037.57 allo... |
high | 8.1 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-95304 Out of bounds write in V8 in Google Chrome prior to 154.0.8037.57 allowed a remo... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95306 Type confusion in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95298 Use after free in Browser in Google Chrome prior to 154.0.8037.57 allowed a loca... |
high | 7.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95285 Missing authorization in WebView in Google Chrome on on Android prior to 154.0.8... |
high | 8.4 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2026-95286 Type confusion in Bindings in Google Chrome prior to 154.0.8037.57 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95278 Missing authorization in WakeLock in Google Chrome prior to 154.0.8037.57 allowe... |
high | 8.4 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2026-95280 Race condition in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote at... |
high | 7.5 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
| CVE-2026-95282 Use after free in Platform in Google Chrome prior to 154.0.8037.57 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.