Week 34, 2026

17–23 August 2026

New CVEs: 3,470
Critical: 547
High: 1,611
Newly exploited: 11
Advisories: 665
Malicious pkgs: 299

Newly exploited 11

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

Critical 10.0
CVE-2026-69836 ENISA Aug 21, 2026 Microsoft Entra ID Remote Code Execution Vulnerability
Microsoft · Microsoft Entra

EPSS 1.8%
High 8.9
CVE-2026-73570 KEV Aug 21, 2026 A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notificat…
Zimbra · Collaboration

EPSS 72%
Critical 9.8
CVE-2026-72529 KEV Aug 20, 2026 A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlie…
TrueConf · TrueConf Server

EPSS 1.5%
Critical 9.0
CVE-2026-72530 KEV Aug 20, 2026 A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlie…
TrueConf · TrueConf Server

EPSS 1.7%
Critical 9.3
CVE-2026-64849 KEV Aug 19, 2026 MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
MLflow · MLflow

EPSS 10%
Critical 9.8
CVE-2026-33824 KEV Aug 18, 2026 Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 77%
Critical 9.8
CVE-2026-65400 KEV Aug 18, 2026 An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, m…
Apple · macOS

EPSS 1.7%
Critical 9.8
CVE-2026-59310 KEV Aug 18, 2026 · ransomware vCenter directory-traversal vulnerability
VMware · Cloud Foundation · Telco Cloud Platform · Telco Cloud Infrastructure

EPSS 62%
Critical 9.1
CVE-2026-55040 KEV Aug 18, 2026 Microsoft SharePoint Server Security Feature Bypass Vulnerability
Microsoft · Microsoft SharePoint Server 2019 · Microsoft SharePoint Enterprise Server 2016 · Microsoft SharePoint Server Subscription Edition

EPSS 70%
Critical 10.0
CVE-2026-41679 ENISA Aug 17, 2026 Paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass
paperclipai · @paperclipai/server · paperclip

EPSS 32%
Critical 9.4
CVE-2025-62593 KEV Aug 17, 2026 Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack
ray-project · ray

EPSS 60%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.3
CVE-2026-19490 NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490
NetScaler · ADC · Gateway

EPSS 33%
Critical 9.3
CVE-2026-64849 MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
MLflow · MLflow

EPSS 10%
Critical 9.3
CVE-2026-19586 Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways
TP-Link Systems · ER706W-4G v2 · ER605 v2 · ER605W v2

EPSS 5.7%
Critical 9.1
CVE-2026-18963 Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
Red Hat · Red Hat Single Sign-On 7 · Red Hat JBoss Enterprise Application Platform Expansion Pack · Red Hat build of Keycloak 26.6

EPSS 4.7%
Critical 9.8
CVE-2026-77806 SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injectio…
SPIP · SPIP

EPSS 4.5%
Critical 9.8
CVE-2026-15748 Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration
wpmudev · Forminator Forms – Contact Form, Payment Form & Custom Form Builder

EPSS 4.1%
Critical 9.8
CVE-2026-76904 GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers
geotools · geotools

EPSS 4%
Critical 9.8
CVE-2026-18482 CVE-2026-18482
Klarso · neo-mjs

EPSS 3.4%
Critical 9.1
CVE-2026-75094 COMFAST CF-N1-S CGI mbox-config sub_44B438 os command injection
Comfast · CF-N1-S

EPSS 3.2%
Critical 9.8
CVE-2026-18315 TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter
themetechmount · TrueBooker – Appointment Booking and Scheduler System

EPSS 3%
Critical 9.9
CVE-2026-77683 Comfast CF-N1-S mbox-config system command injection
Comfast · CF-N1-S

EPSS 2.9%
Critical 9.8
CVE-2026-77647 SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect ide…
SPIP · SPIP

EPSS 2.3%
Critical 9.4
CVE-2026-19478 Improper Control of Generation of Code ('Code Injection') in GitLab
GitLab · GitLab

EPSS 2.2%
Critical 10.0
CVE-2026-18051 W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key
EPSS 2%
Critical 9.0
CVE-2026-32475 WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability
Elementor · Elementor Pro

EPSS 2%

All 547 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

High 7.5
CVE-2026-73522 COVESA Open1722 0.9.2 Stack Buffer Overflow via avtp_to_can() in acf-can-listener
COVESA · Open1722

EPSS 4%
High 8.8
CVE-2026-61400 Apache CloudStack: Get and Run Diagnostics Command Injection
Apache Software Foundation · Apache CloudStack

EPSS 2.9%
Medium 6.6
CVE-2026-19976 COMFAST CF-N1-S mbox-config sub_44A968 command injection
Comfast · CF-N1-S

EPSS 2.9%
High 8.5
CVE-2026-75616 Command Injection in Router Web Management Interface
TP-Link Systems · Archer C20 v6

EPSS 2.8%
High 7.4
CVE-2026-78063 Tenda CH22 editFileName formeditFileName command injection
Tenda · CH22

EPSS 2.7%
High 7.4
CVE-2026-77031 Tenda CH22 formcreateFileName command injection
Tenda · CH22

EPSS 2.7%
High 7.4
CVE-2026-78141 Tenda CH22 exeCommand formexeCommand command injection
Tenda · CH22

EPSS 2.7%
Medium 4.3
CVE-2026-76166 Modcluster-core: mod_cluster advertise listener: unauthenticated dos via crafted multicast datagram
Red Hat · Red Hat Single Sign-On 7 · Red Hat JBoss Enterprise Application Platform Expansion Pack · Red Hat JBoss Enterprise Application Platform 7

EPSS 2.7%

Advisories

USN-8665-1 linux-raspi, linux-raspi-realtime vulnerabilities 912 CVEs
USN-8663-1 linux-nvidia, linux-nvidia-7.0 vulnerabilities 862 CVEs
USN-8664-1 linux-nvidia-bos vulnerabilities 859 CVEs
USN-8668-1 linux-gcp-5.15 vulnerabilities 763 CVEs
SUSE-SU-2026:23241-1 Security update for the Linux Kernel 648 CVEs
SUSE-SU-2026:23193-1 Security update for the Linux Kernel 648 CVEs
SUSE-SU-2026:23244-1 Security update for the Linux Kernel 647 CVEs
SUSE-SU-2026:23194-1 Security update for the Linux Kernel 647 CVEs
NCSC-2026-0306 Kwetsbaarheden verholpen in Oracle Fusion Middleware 262 CVEs
USN-8669-1 linux-nvidia-6.17 vulnerabilities 227 CVEs