Week 32, 2026
3 August to 9 August 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- CVEs published
- 1,847
- Critical
- 294
- High
- 721
- Added to KEV
- 6
Critical 294High 721Medium 747Low 66Not scored 19All 1,847 in the list
Added to KEVAttackers use these now; patch them first
- CVE-2026-8037
OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
Progress Software · LoadMaster
ExploitedCritical9.6 - CVE-2026-63077
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
JetBrains · TeamCity
ExploitedCritical9.8 - CVE-2026-9198
Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation
IBM · Langflow OSS
ExploitedCritical9.8 - CVE-2026-18556
Unauthenticated administrative account takeover
N-able · N-central
ExploitedHigh8.2 - CVE-2026-34486
Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor
Apache Software Foundation · Apache Tomcat
ExploitedHigh7.5 - CVE-2026-18577
Incomplete patch leads to administrative account takeover
N-able · N-central
ExploitedHigh8.2
Most severe new CVEsBy CVSS score
- CVE-2026-5430
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
WSO2 · WSO2 Universal Gateway
ExploitedCritical10.0 - CVE-2026-48168
PraisonAI: GitHub Actions Claude workflow command injection via unquoted PR branch name
MervinPraison · PraisonAI
Critical10.0 - CVE-2026-48323
Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
Adobe · Adobe Campaign Classic
Critical10.0 - CVE-2026-48330
Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Adobe · Adobe Campaign Classic
Critical10.0 - CVE-2026-48331
Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)
Adobe · Adobe Campaign Classic
Critical10.0 - CVE-2026-56162
Azure SQL Database Elevation of Privilege Vulnerability
Microsoft · Azure SQL Database
Critical10.0 - CVE-2026-65553
WordPress Spider Analyser – WordPress搜索引擎蜘蛛分析插件 plugin <= 2.1.3 - Remote Code Execution (RCE) vulnerability
wbolt.com · Spider Analyser – WordPress搜索引擎蜘蛛分析插件
Critical10.0 - CVE-2026-14812
Premium SEO - Unauthenticated Backdoor (Admin Creation / RCE / SSRF / Content Injection)
Unknown · Premium SEO
Critical10.0 - CVE-2026-63508
Microsoft Planetary Computer Pro Elevation of Privilege Vulnerability
Microsoft · Microsoft Planetary Computer Pro (GeoCatalog)
Critical10.0 - CVE-2026-65667
Microsoft Teams Elevation of Privilege Vulnerability
Microsoft · Microsoft Teams
Critical10.0