Weekly Vulnerability Report: Aug 24 – Aug 30, 2026
36 new CVEs were published, 24 of them rated critical or high. 11 were added to CISA's exploited list.
Between August 24, 2026 and August 30, 2026, 36 new vulnerabilities were published, 6% more than the previous week (34). 24 of them, or 67%, were rated high or critical. The busiest day was August 26, 2026, with 18 CVEs.
CISA confirmed active exploitation of 11 vulnerabilities during the week. These are listed first below because attackers are already using them. HCLSoftware had the most new CVEs (3), and improper access control was the most common weakness type (3).
Confirmed exploited this week
- 10.0 Critical severity
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Exploited
Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions that are affected are
- 9.8 Critical severity
Gitea Code Injection Exploited
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
- 7.2 High severity
Red Hat Libuser Race Condition Exploited
libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modificati
- 7.8 High severity
Red Hat Automatic Bug Reporting Tool Privilege Escalation Exploited
The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /va
- 8.8 High severity
Microsoft SQL Server Remote Code Execution Exploited
A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.
- 9.8 Critical severity
Ajax.NET Professional Deserialization of Untrusted Data Exploited
All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.
- 7.8 High severity
Linux Kernel Out-of-Bounds Write Exploited
An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user to gain privileged access or cause a denial of service on th
- 9.8 Critical severity
Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Exploited
Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server
- 9.8 Critical severity
ownCloud Improper Authentication Exploited
An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs
- 7.8 High severity
Linux Kernel Unspecified Exploited
In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are comp
- 5.3 Medium severity
JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Exploited
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.
The 7 most important new vulnerabilities
- 9.8 Critical severity
PaperCut NG/MF Missing Authentication for Critical Function Exploited
An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of
- 9.1 Critical severity
PaperCut NG/MF Unsafe Reflection Exploited
An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approve
- 9.8 Critical severity
Gitea Code Injection Exploited
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
- 9.8 Critical severity
JFrog Artifactory Improper Authentication Exploited
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.
- 8.9 High severity
ceph: Use of a Broken or Risky Cryptographic Algorithm
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the CephX authentication protocol encrypts tickets with AES-128-CBC in an unauthenticated mode that uses a hard-coded initial
- 8.5 High severity
PG5298A: Incorrect Authorization
Firmware in KAON PG5298A and PG5298B routers allow an authenticated user to send crafted JSON-RPC requests and perform operations not possible via GUI, e.g. system file read or command execution. This vulnerability has been fixed in firmware version: 3.0.82 fo
- 7.5 High severity
HCL Hive: Incorrect Default Permissions
HCL Hive is affected by incorrect default permissions which could allow an attacker unauthorized lateral movement, container breakout, and interception of sensitive internal communications.
Vendors with the most new CVEs
Most common weakness types
Severity breakdown
| Severity | CVEs | Share |
|---|---|---|
| Critical | 10 | 28% |
| High | 14 | 39% |
| Medium | 10 | 28% |
| Low | 2 | 6% |
| Not yet scored | 0 | 0% |
This report is compiled from NVD, CISA KEV and CWE data for CVEs published in the week shown. Counts exclude rejected records.