September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,171
Critical
1,210
High
4,305
Medium
4,059
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-56126 pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the... |
medium | 5.4 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-56127 pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the... |
medium | 5.4 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-56128 pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the... |
medium | 5.4 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-87463 Incorrect authorization in Certificate in Google Chrome on on Android prior to 1... |
medium | 4.8 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87458 UI misrepresentation in Geometry in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87461 Information leak in Core in Google Chrome prior to 153.0.8010.36 allowed a remot... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87462 UI misrepresentation in FedCM in Google Chrome prior to 153.0.8010.36 allowed a... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87465 Incorrect authorization in Downloads in Google Chrome prior to 153.0.8010.36 all... |
medium | 4.2 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87466 Incorrect authorization in Workers in Google Chrome prior to 153.0.8010.36 allow... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87449 Cross-site request forgery in DeviceBoundSessionCredentials in Google Chrome pri... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87432 Incorrect authorization in Navigation in Google Chrome prior to 153.0.8010.36 al... |
medium | 4.2 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87653 UI misrepresentation in FullScreen in Google Chrome on on Windows prior to 153.0... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87635 UI misrepresentation in Payments in Google Chrome prior to 153.0.8010.36 allowed... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87655 Clickjacking in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remo... |
medium | 5.4 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87550 Improper encoding or escaping of output in CSS in Google Chrome prior to 153.0.8... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87545 Information leak in Mobile in Google Chrome on on iOS prior to 153.0.8010.36 all... |
medium | 6.5 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87555 Uninitialized resource in GPU in Google Chrome on on Android prior to 153.0.8010... |
medium | 4.7 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87559 UI misrepresentation in UI in Google Chrome prior to 153.0.8010.36 allowed a rem... |
medium | 4.2 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87598 Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87602 Out of bounds read in ANGLE in Google Chrome on on Windows prior to 153.0.8010.3... |
medium | 4.7 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87619 Observable discrepancy in Prefetch in Google Chrome prior to 153.0.8010.36 allow... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87622 Missing authorization in FedCM in Google Chrome prior to 153.0.8010.36 allowed a... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87632 Cross-site scripting in SanitizerAPI in Google Chrome prior to 153.0.8010.36 all... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87562 Incorrect reference resolution in Accessibility in Google Chrome on on Mac prior... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87564 Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote at... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87567 UI misrepresentation in UrlFormatting in Google Chrome prior to 153.0.8010.36 al... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-87568 Improper input validation in Chromium in Google Chrome prior to 153.0.8010.36 al... |
medium | 4.3 | — | Google / chrome | 2026-09-09 | 2026-09-09 |
| CVE-2026-78838 A reflected cross-site scripting (XSS) vulnerability in the grid_datasource.php... |
medium | 6.5 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-78738 Silverpeas Core 6.4.6 is vulnerable to Cross Site Scripting (XSS) via the Docume... |
medium | 6.1 | — | — | 2026-09-08 | 2026-09-09 |
| CVE-2026-75170 Cross-site scripting (XSS) vulnerability in the /loginController/doLogin endpoin... |
medium | 6.1 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-75162 An information disclosure vulnerability in the opcua-configuration method of /cg... |
medium | 6.5 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-49455 Waku is the minimal React framework. |
medium | 6.5 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-85392 Peppermint through 0.5.5 contains an authorization bypass vulnerability in the G... |
medium | 4.3 | — | — | 2026-09-03 | 2026-09-09 |
| CVE-2026-87808 SiYuan versions <= 3.8.1 contain an incomplete fix for CVE-2026-32767 (GHSA-j7wh... |
medium | 4.9 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-38961 Cross-Site Scripting (XSS) vulnerability in the RSS Widget of Netgate pfSense Pl... |
medium | 5.4 | — | — | 2026-09-04 | 2026-09-09 |
| CVE-2026-39020 An issue in WIngs3D v.2.4.1 allows a local attacker to cause a denial of service... |
medium | 5.5 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-82530 IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an acces... |
medium | 5.3 | — | — | 2026-09-09 | 2026-09-09 |
| CVE-2026-80055 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 4.4 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-80177 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application... |
medium | 6.5 | — | Dell / secure connect gateway | 2026-09-09 | 2026-09-09 |
| CVE-2026-83991 Missing authentication for critical function in Windows Cloud Files Mini Filter... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.