September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-82533 DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerab... |
critical | 9.6 | — | — | 2026-09-08 | 2026-09-10 |
| CVE-2026-77770 The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugi... |
critical | 10.0 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-78361 The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4... |
critical | 9.1 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-7188 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
critical | 9.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-9163 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
critical | 9.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-87931 A vulnerability has been found in Behavioral Technology Group Pavlok Behavioral... |
critical | 9.6 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-18351 The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulner... |
critical | 9.8 | — | — | 2026-09-10 | 2026-09-10 |
| CVE-2026-4600 Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verif... |
critical | 9.1 | — | Kjur / jsrsasign | 2026-03-23 | 2026-09-10 |
| CVE-2026-4601 Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Crypto... |
critical | 9.1 | — | Kjur / jsrsasign | 2026-03-23 | 2026-09-10 |
| CVE-2026-42044 Axios is a promise based HTTP client for the browser and Node.js. |
critical | 9.1 | — | Axios / axios | 2026-04-24 | 2026-09-10 |
| CVE-2026-42043 Axios is a promise based HTTP client for the browser and Node.js. |
critical | 10.0 | — | Axios / axios | 2026-04-24 | 2026-09-10 |
| CVE-2026-28802 Authlib is a Python library which builds OAuth and OpenID Connect servers. |
critical | 9.8 | — | Authlib / authlib | 2026-03-06 | 2026-09-10 |
| CVE-2026-27606 Rollup is a module bundler for JavaScript. |
critical | 9.8 | — | Rollupjs / rollup | 2026-02-25 | 2026-09-10 |
| CVE-2026-27459 pyOpenSSL is a Python wrapper around the OpenSSL library. |
critical | 9.8 | — | Pyopenssl / pyopenssl | 2026-03-18 | 2026-09-10 |
| CVE-2024-22373 An out-of-bounds write vulnerability exists in the JPEG2000Codec::DecodeByStream... |
critical | 9.8 | — | Malaterre / grassroots dicom | 2024-04-25 | 2026-09-10 |
| CVE-2026-87643 Integer overflow in GPU in Google Chrome on on Android prior to 153.0.8010.36 al... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87646 Use after free in Web Authentication in Google Chrome prior to 153.0.8010.36 all... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87650 Out of bounds read in WebGL in Google Chrome prior to 153.0.8010.36 allowed a re... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87654 Buffer overflow in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 a... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87634 Use after free in WebPackaging in Google Chrome prior to 153.0.8010.36 allowed a... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87637 Use after free in Extensions in Google Chrome on on Mac prior to 153.0.8010.36 a... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87638 Out of bounds write in Media in Google Chrome prior to 153.0.8010.36 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87621 Out of bounds write in ANGLE in Google Chrome on on Windows prior to 153.0.8010.... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87607 Use after free in Device in Google Chrome on on Mac prior to 153.0.8010.36 allow... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87609 Use after free in Sharing in Google Chrome on on iOS prior to 153.0.8010.36 allo... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87613 Incorrect reference resolution in Extensions in Google Chrome prior to 153.0.801... |
critical | 9.0 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87581 Use after free in Payments in Google Chrome prior to 153.0.8010.36 allowed a rem... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87558 Use after free in Payments in Google Chrome on on Mac prior to 153.0.8010.36 all... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87547 Incorrect reference resolution in FileSystem in Google Chrome prior to 153.0.801... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87528 Type confusion in Rust in Google Chrome on on Windows prior to 153.0.8010.36 all... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87529 Numeric truncation error in Media in Google Chrome prior to 153.0.8010.36 allowe... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87512 Use after free in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 al... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87520 Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.36 all... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87526 Use after free in Passwords in Google Chrome prior to 153.0.8010.36 allowed a re... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87527 Buffer overflow in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remot... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87500 Improper validation of array index in ANGLE in Google Chrome prior to 153.0.8010... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87504 Use after free in Core in Google Chrome prior to 153.0.8010.36 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87488 Use after free in WebGL in Google Chrome on on Android prior to 153.0.8010.36 al... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87492 Incorrect authorization in DevTools in Google Chrome prior to 153.0.8010.36 allo... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
| CVE-2026-87470 Improper quantity validation in Tint in Google Chrome on on Mac prior to 153.0.8... |
critical | 9.6 | — | Google / chrome | 2026-09-09 | 2026-09-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.