CVE Tools
Sign in
month report

August 2026

Data as of Sep 7, 2026, 05:00 UTCSnapshot v1 Sources CVEList V5+NVD+GHSA+CSAF+FSTEC BDU+CISA KEV+EPSS+Nuclei templates Methodology →

August 2026 closed with 12,909 published CVEs — +233.5% YoY . 1,589 criticals, 31 added to CISA KEV. linux led volume, mostly via linux. Biggest breakout: splunk at ×14.7 their 12-month median. Top weakness class — CWE-284 (1,202 CVE). 10 vendors cracked the top-100 for the first time.

Print view
Total CVEs
12,909
+26.1% MoM+233.5% YoY
Severity mix
1,589 / 4,889
critical / high
KEV added
31
0 ransomware-linked
Nuclei coverage
0.3%
33 CVEs with templates

Time to exploit

How fast the community ships detection after a CVE drops.

Days → Nuclei (median)
6.6
n=29
Within 7 days
65.5%
Within 30 days
96.6%
Days → KEV (median)
3
n=14
Detection gap

KEV pressure, no Nuclei coverage

August 2026 · vendors with active exploitation listed by CISA but no public detection template.

Weakness × Vendor

What's spreading where in August 2026

Cells shaded by share of vendor's hottest weakness. Click any cell to open the CWE history.

284CWE-28479XSS862Missing Authorization22Path Traversal89SQL Injection918SSRF863Incorrect Authorization639Auth Bypass via User Key200Information Exposure78OS Command Injectionlinuxoracle corporation81920oracle80819microsoft7131243147382google112251351ibm233247423528red hat46495813apache software foundation46425876102apache46425875102splunk5812535424adobe4333154spring34441

Most discussed CVEs — August 2026

Breakout vendors

CVE count ≥3× their own 12-period median.

First time in top-100

Vendors never in top-100 in the prior 24 periods.

Top vendors

Ranked by distinct CVE count this period.

  • 1linux↑1
    1,645 CVE212 critCVSS 8.3
    ×3.7
    linux (1645)
  • 2oracle↓1
    890 CVE144 critCVSS 7.5
    ×9.9
    helidon (99) · hyperion financial management (80) · oracle hyperion financial management (78)
  • 3microsoft·
    479 CVE35 critCVSS 7.2
    ×3.4KEV 1
    windows server 2025 (server core installation) (214) · windows server 2025 (214) · windows 11 26h1 (195)
  • 4google·
    402 CVE54 critCVSS 6.7
    chrome (396) · android (2) · @a2ui/web_core (1)
  • 5ibm↑6
    390 CVE51 critCVSS 7.5
    ×8.5
    powervm vios (145) · aix (145) · vios (145)
  • 6redhat↑1
    228 CVE21 critCVSS 6.8
    Nuclei 1
    red hat enterprise linux 9 (98) · red hat enterprise linux 8 (94) · red hat enterprise linux 7 (83)
  • 7apache software foundation↓2
    167 CVE39 critCVSS 7.5
    ×7.6
    apache cloudstack (20) · apache airflow (12) · apache cxf (12)
  • 8apache↑1
    163 CVE39 critCVSS 7.5
    ×8.2
    cloudstack (20) · airflow (12) · cxf (12)
  • 9splunk—
    110 CVE4 critCVSS 6.6
    ×14.7
    splunk enterprise (60) · splunk (60) · splunk soar (15)
  • 10adobe·
    101 CVE15 critCVSS 7.2
    Nuclei 1
    content credentials rust sdk (21) · c2pa (20) · c2patool (20)
  • 11spring—
    91 CVE7 critCVSS 6.1
    ×4.5
    spring framework (17) · spring integration (14) · spring ai (7)
  • 12siyuan-note↑97
    81 CVE16 critCVSS 7.4
    ×7.4Nuclei 1
    siyuan (81)
  • 13dell↑6
    72 CVE5 critCVSS 7.5
    command update (11) · dell command update (dcu) (11) · openmanage enterprise (10)
  • 14getgrav↑10
    66 CVE3 critCVSS 7.1
    ×3.0
    grav (55) · grav-plugin-api (7) · grav-plugin-login (3)
  • 15jahlives—
    66 CVE18 critCVSS 7.3
    NEW
    openssl_encrypt (66) · openssl encrypt (58)
  • 16vmware↑94
    64 CVE7 critCVSS 6.1
    ×5.8
    spring integration (13) · spring framework (10) · spring security (7)
  • 17mozilla↓5
    60 CVE17 critCVSS 8.0
    firefox (59) · thunderbird (55) · firefox mobile (4)
  • 18zephyrproject↑19
    57 CVE1 critCVSS 5.9
    zephyr (57)
  • 19pypi↑10
    56 CVE
    nltk (24) · gitpython (9) · wagtail (4)
  • 20mongodb↑20
    55 CVE1 critCVSS 6.7
    ×4.6
    mongodb server (24) · bi connector (8) · bi connector odbc driver (7)
  • 21nvidia↓1
    52 CVE4 critCVSS 7.3
    dynamo (15) · nemoclaw (12) · triton inference server (6)
  • 22elastic↑11
    49 CVECVSS 6.5
    ×7.0
    kibana (32) · elasticsearch (14) · elastic cloud on kubernetes (2)
  • 23gitea·
    49 CVE8 critCVSS 6.6
    ×4.9KEV 1Nuclei 1
    gitea open source git server (47) · gitea (2)
  • 24sourcecodester↓8
    49 CVECVSS 5.9
    simple online food ordering system (13) · class and exam timetabling system (8) · photo share website (5)
  • 25cisco↑30
    48 CVE13 critCVSS 7.9
    KEV 1PoC 46
    cisco ios xe software (12) · cisco secure endpoint (7) · ios xe (7)
  • 26go↑4
    46 CVE
    github.com/siyuan-note/siyuan/kernel (25) · github.com/rclone/rclone (7) · github.com/coder/coder/v2 (2)
  • 27itsourcecode↑48
    45 CVECVSS 6.6
    hospital management system (19) · sales and inventory system (12) · online medicine delivery system (6)
  • 28apple↓22
    44 CVE2 critCVSS 5.4
    KEV 1
    iphone os (35) · ios and ipados (35) · ipados (34)
  • 29packagist↑18
    41 CVE
    craftcms/cms (16) · winter/wn-backend-module (6) · guzzlehttp/guzzle (4)
  • 30ash-project—
    40 CVECVSS 6.5
    NEW
    ash_admin (7) · ash_ai (6) · ash_graphql (6)
  • 31draytek corporation—
    40 CVE3 critCVSS 7.2
    NEW
    vigorswitch q2300x (29) · vigorswitch pq2121x (29) · vigorswitch pq2200xb (29)
  • 32dokploy—
    37 CVE22 critCVSS 9.2
    NEW×3.4
    dokploy (37)
  • 33flowiseai—
    37 CVE3 critCVSS 8.1
    Nuclei 1
    flowise (37) · flowise-components (1)
  • 34budibase—
    36 CVE4 critCVSS 7.7
    ×5.1
    budibase (21) · server (15)
  • 35sap_se↑50
    35 CVE3 critCVSS 6.0
    sap business ai platform (approuter) (11) · sap manufacturing integration and intelligence (5) · sap data services management console (1)
  • 36tp-link systems inc.↑101
    35 CVE1 critCVSS 7.9
    omada gateways (7) · omada switches (7) · xx530v(br)v2.0 (5)
  • 37bouncycastle—
    34 CVE3 critCVSS 7.2
    NEW×6.8
    bc-java (32) · bc-lts-java (28) · bouncy castle for java lts (28)
  • 38freerdp↑125
    34 CVE3 critCVSS 6.8
    freerdp (34)
  • 39langflow↑37
    34 CVE3 critCVSS 7.7
    ×3.1
    langflow (34)
  • 40mediatek, inc.↑146
    34 CVECVSS 5.8
    mediatek chipset (34)
  • 41n8n-io↑36
    34 CVE3 critCVSS 7.4
    n8n (34)
  • 42intel—
    33 CVECVSS 6.5
    proset\/wireless wifi (21) · neural processing unit driver (3) · tdx module (3)
  • 43npm↓35
    33 CVE
    axios (9) · flowise (4) · nuxt (2)
  • 44rsyncproject—
    33 CVE1 critCVSS 7.0
    NEW
    rsync (33)
  • 45freebsd—
    32 CVE2 critCVSS 7.5
    ×3.6
    freebsd (32)
  • 46nltk—
    32 CVE3 critCVSS 6.6
    NEW
    nltk (31) · nltk/nltk (3)
  • 47code-projects↓20
    30 CVECVSS 6.1
    online shopping system (9) · task management system (6) · simple inventory system (4)
  • 48jfrog↑55
    30 CVE1 critCVSS 6.1
    NEWKEV 2Nuclei 1
    artifactory (30)
  • 49watchguard↑32
    30 CVE
    PoC 30
    dimension (16) · fireware os (12) · watchguard agent (2)
  • 50postgresql—
    28 CVECVSS 7.1
    NEW
    postgresql (28)

Top weaknesses

CWE classes by distinct CVE count.

1CWE-2841,202·
2CWE-79769·
3CWE-862627·
4CWE-89452·
5CWE-22451↑2
6CWE-918356↑5
7CWE-863335↑2
8CWE-639332↑4
9CWE-200329↓3
10CWE-78313↑8
11CWE-94263↑8
12CWE-20251↓2
13CWE-787247↑7
14CWE-125237·
15CWE-74233↑7
16CWE-306228↓11
17CWE-122224·
18CWE-416220↓10
19CWE-269207↓6
20CWE-770195↑1

Sectors

Solution categories ranked by distinct CVE count this period.

  • Operating Systems2,693 CVE
    384 crit28 KEV37 vendorsCVSS 7.5
    linux (1645) · red hat enterprise linux 9 (98) · red hat enterprise linux 8 (94)
  • Enterprise Software1,591 CVE
    205 crit4 KEV152 vendorsCVSS 8.2
    vios (145) · oracle hyperion infrastructure technology (67) · hyperion data relationship management (35)
  • Web & CMS Plugins1,418 CVE
    199 crit537 vendorsCVSS 8.2
    commerce experience manager (58) · grav (55) · oracle webcenter sites (18)
  • OSS Libraries1,308 CVE
    127 crit238 vendorsCVSS 7.8
    rsync (50) · langflow oss (34) · bc-java (31)
  • Consumer Software1,033 CVE
    145 crit73 vendorsCVSS 7.6
    chrome (396) · firefox (59) · microsoft edge (chromium-based) (24)
  • Databases936 CVE
    146 crit50 vendorsCVSS 8.3
    oracle hyperion financial management (78) · oracle commerce guided search / oracle commerce experience manager (61) · oracle reports developer (41)
  • Cloud & SaaS869 CVE
    210 crit116 vendorsCVSS 7.7
    microsoft 365 (73) · n8n (27) · budibase (21)
  • Networking Infrastructure548 CVE
    296 crit4 KEV80 vendorsCVSS 7.7
    cisco ios xe software (12) · fireware os (12) · a800r (9)
  • Security Products532 CVE
    91 crit6 KEV98 vendorsCVSS 7.3
    splunk (60) · splunk enterprise (60) · wireshark (28)
  • Hardware Firmware371 CVE
    271 crit61 vendorsCVSS 8.4
    mediatek chipset (34) · power system e1080 \(9080-hex\) firmware (26) · power system e950 \(9040-mr9\) firmware (21)
  • DevTools & CI353 CVE
    24 crit3 KEV57 vendorsCVSS 7.6
    gitea open source git server (47) · artifactory (30) · red hat quay 3 (9)
  • AI / ML278 CVE
    28 crit2 KEV64 vendorsCVSS 7.9
    flowise (37) · langflow (34) · praisonai (21)
  • Communications207 CVE
    31 crit3 KEV44 vendorsCVSS 8.1
    thunderbird (55) · webmail (10) · electerm (7)
  • ICS / OT / IoT132 CVE
    23 crit43 vendorsCVSS 7.6
    s2opc (4) · bpc 9202s (3) · libiec61850 (3)
  • Mobile Apps19 CVE
    2 crit6 vendorsCVSS 8.1
    smart switch (4) · samsung health (3) · karakeep (2)
  • Unclassified106 CVE
    25 crit39 vendorsCVSS 7.8
    .net 10.0 (8) · luci (8) · siebel apps - marketing (8)
Weakness × Sector

Which weaknesses hit which solution categories in August 2026

Cells shaded by share of the sector's hottest weakness. Click a row to open the sector history.

284CWE-28479XSS862Missing Authorization22Path Traversal89SQL Injection918SSRF863Incorrect Authorization639Auth Bypass via User Key200Information Exposure78OS Command InjectionOperating Systems1210192381816102025Enterprise Software576775121921936254125Web & CMS Plugins9831117556156342769297OSS Libraries97553681143837174420Consumer Software72753179117875225Databases5445221656189207Cloud & SaaS32154028144131411846Security Products3817272011131691115Networking Infrastructure161441281574265DevTools & CI2011442122619112211