Week 35, 2026
24–30 August 2026
Newly exploited 15
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
- Critical 9.4 EPSS 63%
- High 8.8 EPSS 85%
-
Critical 9.8
CVE-2023-49105 KEV Aug 27, 2026 An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of …EPSS 43%
-
Critical 9.8
CVE-2026-74233 ENISA Aug 27, 2026 Zbtlink MQWrt infosrvd Command InjectionEPSS 3.4%
Zbtlink · WE826-T2 · WE5926-EC_QP · WE826-Q
- Critical 9.8
- High 7.8
- Medium 5.3
-
High 8.8
CVE-2026-8452 KEV Aug 26, 2026 Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of ServiceEPSS 1%
-
High 8.8
CVE-2019-1068 KEV Aug 26, 2026 A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Re…EPSS 57%
Microsoft · Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR) · Microsoft SQL Server · Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU)
- High 8.1 EPSS 83%
-
High 7.8
CVE-2015-5287 KEV Aug 26, 2026 The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlin…EPSS 5%
-
High 7.8
CVE-2022-0995 KEV Aug 26, 2026 An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel …EPSS 8.9%
-
High 7.4
CVE-2015-3246 KEV Aug 26, 2026 libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local u…EPSS 8.5%
- Critical 9.8 EPSS 24%
-
Critical 10.0
CVE-2026-21962 KEV Aug 24, 2026 Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for…EPSS 73%
Oracle · Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.4 EPSS 63%
- Critical 9.8 EPSS 24%
- Critical 9.8 EPSS 14%
- Critical 10.0 EPSS 7.2%
- Critical 10.0 EPSS 5.1%
- Critical 10.0 EPSS 5%
- Critical 9.8 EPSS 4.7%
-
Critical 9.8
CVE-2026-19632 TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link DisclosureEPSS 4.5%
Cozmoslabs · TranslatePress – Translate Multilingual sites with AI Translation
-
Critical 10.0
CVE-2026-76195 Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)EPSS 3.5%
-
Critical 10.0
CVE-2026-76197 Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)EPSS 3.5%
- Critical 9.8 EPSS 3.4%
-
Critical 9.8
CVE-2026-37751 An OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arb…EPSS 2.9%
-
Critical 9.8
CVE-2026-71921 DrayTek VigorSwitch Multiple Models Pre-Authentication OS Command Injection via setget.cgiEPSS 2.8%
DrayTek · VigorSwitch P2540xs · VigorSwitch P2121 · VigorSwitch PX2060
-
Critical 9.8
CVE-2026-19092 Tutor LMS < 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable ShadowingEPSS 2.6%
- Critical 9.8 EPSS 2.6%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- High 8.8 EPSS 85%
-
Medium 6.4
CVE-2026-47864 Unsafe Java deserialization in SerializingHttpMessageConverter — remote code executionEPSS 5.9%
- High 7.4 EPSS 4.4%
-
High 8.7
CVE-2026-9254 Command Injection Vulnerability in Parent Control of Multiple TP-Link Archer DevicesEPSS 3.1%
TP-Link Systems · Archer BE3600 v1 · Archer BE800 V1 · Archer AX75 V1
-
High 8.3
CVE-2026-38820 openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /opennds_preaut…EPSS 2.9%
-
Medium 6.8
CVE-2026-24168 NVIDIA UFM Enterprise contains a vulnerability in the IBDiagnet API where an authenticated attacker with administrative privileges may cause command injection …EPSS 2.8%
NVIDIA · Unified Fabric Manager Enterprise - GA · Unified Fabric Manager Enterprise - LTS 2024 · Unified Fabric Manager Enterprise - LTS 2025
-
High 8.8
CVE-2026-65091 NVIDIA OpenShell for all platforms contains a vulnerability where a malicious gateway could cause OS command injection. A successful exploit of this vulnerabil…EPSS 2.6%
-
Medium 6.8
CVE-2026-65086 NVIDIA OpenShell for Linux contains a vulnerability in its sandbox exec handler, where an attacker could cause an OS command injection. A successful exploit of…EPSS 2.4%
Advisories
- SUSE / openSUSE Security Updates 332135 critical
- Red Hat Security Advisories (RHSA) 21048 critical
- BSI CERT-Bund (WID) 1215 critical
- Rocky Linux Security Advisories 63
- AlmaLinux Security Advisories 51
- Ubuntu Security Notices (USN) 3314 critical
- openSUSE-SU-2026:11628-1 chromedriver-152.0.7977.64-1.1 on GA media 327 CVEs
- SUSE-SU-2026:3790-1 Security update for the Linux Kernel 268 CVEs
- SUSE-SU-2026:3810-1 Security update for the Linux Kernel 267 CVEs
- openSUSE-SU-2026:21650-1 Security update for rsync 41 CVEs
- SUSE-SU-2026:23289-1 Security update for rsync 41 CVEs
- SUSE-SU-2026:23323-1 Security update for rsync 41 CVEs
- SUSE-SU-2026:23253-1 Security update for rsync 37 CVEs
- LSN-0121-1 Kernel Live Patch Security Notice 34 CVEs
- SUSE-SU-2026:23254-1 Security update for rsync 33 CVEs
- USN-8666-3 linux-gcp-fips vulnerabilities 32 CVEs