September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100782 Privilege escalation due to incorrect boundary conditions in the Graphics compon... |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100784 Use-after-free in the Layout: Text and Fonts component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100785 Use-after-free in the DOM: Core & HTML component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100789 Use-after-free in the Graphics: Canvas2D component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100776 Use-after-free in the JavaScript: WebAssembly component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-06 |
| CVE-2026-100777 Use-after-free in the Graphics: Canvas2D component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100779 Use-after-free in the XSLT component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100780 Use-after-free in the DOM: Core & HTML component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100768 Use-after-free in the Graphics: WebGPU component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-06 |
| CVE-2026-100769 Use-after-free in the JavaScript: WebAssembly component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-06 |
| CVE-2026-100771 Undefined behavior in the DOM: Streams component. |
high | 8.1 | — | Mozilla / firefox | 2026-09-29 | 2026-10-06 |
| CVE-2026-100772 Use-after-free in the DOM: Core & HTML component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-06 |
| CVE-2026-100773 Use-after-free in the Storage: IndexedDB component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-06 |
| CVE-2026-100774 Use-after-free in the DOM: Core & HTML component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-06 |
| CVE-2026-100757 Use-after-free in the Widget component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100759 Uninitialized memory in the Storage: Quota Manager component. |
high | 8.1 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100761 Privilege escalation due to use-after-free in the Graphics: WebGPU component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100764 Privilege escalation due to incorrect boundary conditions in the Graphics: WebGP... |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100765 Use-after-free in the JavaScript: WebAssembly component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100767 Use-after-free in the Networking: Cache component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-06 |
| CVE-2026-100756 Incorrect boundary conditions in the Audio/Video: Playback component. |
high | 8.1 | — | Mozilla / firefox | 2026-09-29 | 2026-10-06 |
| CVE-2026-87748 Missing Authorization vulnerability in Interprobe Information Technologies Inc. |
high | 8.8 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-95520 A heap-based buffer overflow flaw was found in rpm. |
high | 7.1 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-73594 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 8.8 | — | Dell / policy manager for secure connect gateway | 2026-09-29 | 2026-10-15 |
| CVE-2026-73597 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 8.1 | — | Dell / policy manager for secure connect gateway | 2026-09-29 | 2026-10-15 |
| CVE-2026-102495 Apache XmlSchema doesn't limit how deeply schema imports and includes can be nes... |
high | 7.5 | — | Apache / xmlschema | 2026-09-29 | 2026-10-06 |
| CVE-2026-102496 Apache XmlSchema doesn't limit how deeply schema structures can be nested when i... |
high | 7.5 | — | Apache / xmlschema | 2026-09-29 | 2026-10-06 |
| CVE-2026-102497 The Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles in type der... |
high | 7.5 | — | Apache / xmlschema | 2026-09-29 | 2026-10-06 |
| CVE-2026-96423 X11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial... |
high | 7.1 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-14 |
| CVE-2026-96419 Profile import crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of serv... |
high | 7.8 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-95389 SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denia... |
high | 8.1 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-95387 SPDY protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denia... |
high | 8.8 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-84739 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11... |
high | 8.7 | — | Gitlab / gitlab | 2026-09-29 | 2026-10-05 |
| CVE-2026-76718 A potential security vulnerability in HPE OneView can be exploited to allow remo... |
high | 8.2 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-76719 A security vulnerability in HPE OneView may be exploited remotely to perform ses... |
high | 8.2 | — | — | 2026-09-29 | 2026-09-29 |
| CVE-2026-92142 Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which e... |
high | 8.8 | — | Apache / karaf | 2026-09-29 | 2026-10-07 |
| CVE-2026-86158 Missing authentication in the local .NET backend (Fiddler.WebUi) of Progress Sof... |
high | 7.7 | — | — | 2026-09-29 | 2026-09-30 |
| CVE-2026-102293 A vulnerability was identified in realjerrytang tacomall 1.0.0. |
high | 7.3 | — | — | 2026-09-29 | 2026-10-02 |
| CVE-2026-97024 A path traversal vulnerability in Flatpak's handling of the files/etc directory... |
high | 7.1 | — | — | 2026-09-29 | 2026-10-26 |
| CVE-2026-102422 shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by... |
high | 8.1 | — | — | 2026-09-29 | 2026-09-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.