CVE Tools
Track your stack

August 2026

12,909 CVEs published, +26% on July 2026 and 3.3× August 2025. CISA added 31 to KEV.

2026 month by month

2026, month by month. Point at another month to read it.
2026: CVEs published per month
YearJanFebMarAprMayJunJulAugSepOctNovDecYear total
2026January 2026: 5,244 CVEs17 added to CISA KEVFebruary 2026: 4,931 CVEs28 added to CISA KEVMarch 2026: 6,821 CVEs26 added to CISA KEVApril 2026: 6,440 CVEs31 added to CISA KEVMay 2026: 7,365 CVEs21 added to CISA KEVJune 2026: 8,314 CVEs23 added to CISA KEVJuly 2026: 10,240 CVEs26 added to CISA KEVAugust 2026: 12,909 CVEs31 added to CISA KEVSeptember 2026: 15,180 CVEs43 added to CISA KEVOctober 2026: 17,650 CVEs36 added to CISA KEVNovember 2026 so far: 181 CVEs95,275+125%so far
Critical
1,58915% of the 10,466 with a CVSS score
Added to CISA KEV
3114 of this month's CVEs are in KEV, listed a median 2.5 days after publication
Vendors
2,1515,622 products
Top weakness
Improper Access ControlCWE-284 · 1,202 CVEs

Who drove it

Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.

  1. 1LinuxLinux1,645212none+1
  2. 2OracleHelidon, Hyperion Financial Management, Oracle Hyperion Financial Management890144none−1
  3. 3MicrosoftWindows Server 2025 (Server Core Installation), Windows Server 2025, Windows 11 26h1479351—
  4. 4GoogleChrome, Android, @a2ui/web_core40254none—
  5. 5IBMPowervm Vios, Aix, Vios39051none+6
  6. 6Red HatRed Hat Enterprise Linux 9, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 722821none+1
  7. 7Apache Software FoundationApache Cloudstack, Apache Airflow, Apache Cxf16739none−2
  8. 8ApacheCloudstack, Airflow, Cxf16339none+1
  9. 9SplunkSplunk Enterprise, Splunk, Splunk Soar1104nonenew
  10. 10AdobeContent Credentials Rust Sdk, C2PA, C2PATOOL10115none—
  11. 11SpringSpring Framework, Spring Integration, Spring AI917nonenew
  12. 12Siyuan-noteSiyuan8116none+97
  13. 13DellCommand Update, Dell Command Update (Dcu), Openmanage Enterprise725none+6
  14. 14GetgravGrav, Grav-plugin-api, Grav-plugin-login663none+10
  15. 15JahlivesOpenssl_encrypt, OpenSSL Encrypt6618nonenew
  16. 16VMwareSpring Integration, Spring Framework, Spring Security647none+94
  17. 17MozillaFirefox, Thunderbird, Firefox Mobile6017none−5
  18. 18ZephyrprojectZephyr571none+19
  19. 19PyPINltk, Gitpython, Wagtail560none+10
  20. 20MongodbMongodb Server, Bi Connector, Bi Connector Odbc Driver551none+20
  21. 21NvidiaDynamo, Nemoclaw, Triton Inference Server524none−1
  22. 22ElasticKibana, Elasticsearch, Elastic Cloud On Kubernetes490none+11
  23. 23GiteaGitea Open Source Git Server, Gitea4981—
  24. 24SourcecodesterSimple Online Food Ordering System, Class and Exam Timetabling System, Photo Share Website490none−8
  25. 25CiscoCisco IOS XE Software, Cisco Secure Endpoint, IOS XE48131+30

Severity

How this month's CVEs score on CVSS; 2,443 have no score yet. Severity is not exploitation.

  • Critical1,58915%
  • High4,88947%
  • Medium3,60834%
  • Low3804%

Breakouts

Vendors with at least three times their own 12-month median.

  1. Splunk11014.7×
  2. Oracle8909.9×
  3. IBM3908.5×
  4. Apache1638.2×
  5. Apache Software Foundation1677.6×
  6. Siyuan-note817.4×
  7. Elastic497.0×
  8. Bouncycastle346.8×
  9. VMware645.8×
  10. Budibase365.1×

New in the top 100

Not in the top 100 in any of the 24 months before.

  1. Jahlives66#15
  2. Ash-project40#30
  3. Draytek Corporation40#31
  4. Dokploy37#32
  5. Bouncycastle34#37
  6. Rsyncproject33#44
  7. Nltk32#46
  8. Jfrog30#48
  9. Postgresql28#50
  10. Arcadedata25#55

What kind of weakness

Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.

  1. CWE-284Improper Access Control1,202—
  2. CWE-79XSS769—
  3. CWE-862Missing Authorization627—
  4. CWE-89SQL Injection452—
  5. CWE-22Path Traversal451+2
  6. CWE-918SSRF356+5
  7. CWE-863Incorrect Authorization335+2
  8. CWE-639Auth Bypass via User Key332+4
  9. CWE-200Information Exposure329−3
  10. CWE-78OS Command Injection313+8
  11. CWE-94Code Injection263+8
  12. CWE-20Improper Input Validation251−2
  13. CWE-787Out-of-bounds Write247+7
  14. CWE-125Out-of-bounds Read237—
  15. CWE-74Injection233+7
  16. CWE-306Missing Auth for Critical Function228−11
  17. CWE-122Heap Buffer Overflow224—
  18. CWE-416Use After Free220−10
  19. CWE-269Improper Privilege Mgmt207−6
  20. CWE-770Allocation Without Limits195+1

Where it landed

The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.

Area is CVEs this month. Point at a sector to read it.

Which weakness, where

The top weakness classes against the vendors and the sectors that carried them.

The lighter the cell, the more CVEs. Point at one to read it.

August 2026: weakness classes by vendor and by sector: By vendor
By vendor284Improper Access Control79XSS862Missing Authorization22Path Traversal89SQL Injection918SSRF863Incorrect Authorization639Auth Bypass via User Key200Information Exposure78OS Command Injection
Linux1011
Oracle Corporation81820
Oracle81419
Microsoft6131243147382
Google112251351
IBM233247423528
Red Hat46495813
Apache Software Foundation46425876102
Apache46425875102
Splunk5812535424
Adobe4333154
Spring34441

In the news

The CVEs security news mentioned most in August 2026.

  1. CVE-2026-68820Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability227.0
  2. CVE-2026-18577Incomplete patch leads to administrative account takeover178.1
  3. CVE-2026-55040Microsoft SharePoint Server Security Feature Bypass Vulnerability159.1
  4. CVE-2026-18556Unauthenticated administrative account takeover147.4
  5. CVE-2026-19478Improper Control of Generation of Code ('Code Injection') in GitLab139.4
  6. CVE-2026-62832Windows User Profile Service Elevation of Privilege Vulnerability137.8
  7. CVE-2026-63520Microsoft SharePoint Server Remote Code Execution Vulnerability138.1
  8. CVE-2026-65400An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, macOS Tahoe 26.7. A...139.8
  9. CVE-2026-50656Microsoft Defender Elevation of Privilege Vulnerability107.8
  10. CVE-2026-62878Windows DNS Server Remote Code Execution Vulnerability109.8
  11. CVE-2026-66066Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing10—
  12. CVE-2026-19490NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-1949099.8

CVEs published in August 2026

264 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS. Showing 101–200.

Snapshot v1, computed Sep 7, 2026, 05:00 UTC. MethodologyAll months on record

Nuclei coverage and the detection gap are held back while the template mirror is repaired.