September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,828
Low
527
Severity not reported
2,542
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), linux (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92215 A vulnerability has been found in a2ui-project a2ui up to 0.10.7. |
high | 7.3 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-73446 On affected platforms running Arista EOS with IS-IS configured on a broadcast in... |
high | 7.4 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-73459 On affected platforms running Arista EOS with IS-IS configured, an unauthenticat... |
high | 7.4 | — | — | 2026-09-16 | 2026-09-16 |
| CVE-2026-85893 Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacke... |
high | 8.8 | — | Microsoft / edge chromium | 2026-09-15 | 2026-09-25 |
| CVE-2026-69486 Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthor... |
high | 8.8 | — | Microsoft / edge chromium | 2026-09-15 | 2026-09-25 |
| CVE-2026-92248 A flaw was found in the file-psd plugin in GIMP. |
high | 7.8 | — | — | 2026-09-15 | 2026-10-19 |
| CVE-2026-83357 Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Ja... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-83368 Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition,... |
high | 7.0 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-83408 Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Ja... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-22 |
| CVE-2026-76870 Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability... |
high | 7.1 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-76866 Netcore NR255-V firmware version 1.5.130703 builds root-run command lines from u... |
high | 7.2 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-76869 Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in reb... |
high | 7.2 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-76860 Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in wak... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-76861 Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in nto... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-76862 Netcore NR255-V version 1.5.130703 contains an os command argument injection vul... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-76853 Netcore NR268 firmware version 1.7.121109 contains a security check bypass vulne... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-16 |
| CVE-2026-76856 Netcore NR255-V firmware version 1.5.130703 contains a cross-site request forger... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-21 |
| CVE-2026-76852 Netcore NR268 firmware version 1.7.121109 has an improper integrity verification... |
high | 8.8 | — | — | 2026-09-15 | 2026-09-17 |
| CVE-2026-10144 Rsbuild before 2.0.9 contains a command injection vulnerability that allows atta... |
high | 7.8 | — | — | 2026-09-15 | 2026-09-23 |
| CVE-2026-92000 adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output li... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-24 |
| CVE-2026-91743 Race condition in Core in Google Chrome prior to 153.0.8010.47 allowed a remote... |
high | 8.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91745 Use after free in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91748 Race condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 a... |
high | 8.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91735 Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.47 allowed... |
high | 8.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91736 Use after free in DOM in Google Chrome prior to 153.0.8010.47 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91737 Use after free in PDF in Google Chrome prior to 153.0.8010.47 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91741 Type confusion in CacheStorage in Google Chrome prior to 153.0.8010.47 allowed a... |
high | 8.8 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91731 Type confusion in Compositing in Google Chrome prior to 153.0.8010.47 allowed a... |
high | 8.8 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91732 Missing authorization in AppManifest in Google Chrome prior to 153.0.8010.47 all... |
high | 8.1 | — | Google / chrome | 2026-09-15 | 2026-09-18 |
| CVE-2026-91733 Improper state validation in Skia in Google Chrome prior to 153.0.8010.47 allowe... |
high | 8.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91734 Incorrect authorization in Core in Google Chrome on on Windows prior to 153.0.80... |
high | 7.4 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91721 Use after free in Internals in Google Chrome prior to 153.0.8010.47 allowed a re... |
high | 8.8 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91722 Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91724 Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote... |
high | 8.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91727 Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to... |
high | 8.1 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91712 Race condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 a... |
high | 8.3 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91715 Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed... |
high | 8.8 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
| CVE-2026-91719 Code injection in XML in Google Chrome prior to 153.0.8010.47 allowed a remote a... |
high | 8.1 | — | Google / chrome | 2026-09-15 | 2026-09-18 |
| CVE-2026-88065 `tts-be` is a backend for a timetable selector that aims to help students better... |
high | 7.5 | — | — | 2026-09-15 | 2026-09-30 |
| CVE-2026-91709 Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed... |
high | 8.8 | — | Google / chrome | 2026-09-15 | 2026-09-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.