Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage

Week 33, 2026

10 August to 16 August 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.

CVEs published
3,875
Critical
465
High
1,721
Added to KEV
3

Critical 465High 1,721Medium 1,072Low 78Not scored 539All 3,875 in the list

Added to KEVAttackers use these now; patch them first

  • CVE-2026-72898

    Metabase SQL injection via password reset endpoint

    Metabase · Metabase

    ExploitedCritical10.0
  • CVE-2026-20349

    Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability

    Cisco · Cisco Secure Firewall Adaptive Security Appliance (ASA) Software

    ExploitedHigh8.6
  • CVE-2026-68820

    Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

    Microsoft · Windows 10 Version 1607

    ExploitedHigh7.0

Most severe new CVEsBy CVSS score

  • CVE-2026-72898

    Metabase SQL injection via password reset endpoint

    Metabase · Metabase

    ExploitedCritical10.0
  • CVE-2026-48362

    ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

    Adobe · ColdFusion 2025

    Critical10.0
  • CVE-2026-19188

    Haiwell IoT Cloud HMI Gateway OS Command Injection

    Haiwell · Haiwell IoT Cloud HMI Gateway

    Critical10.0
  • CVE-2026-73299

    Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer

    microsoft · prompty

    Critical10.0
  • CVE-2026-73678

    MindsDB Minds Platform v26.1.0 Unauthenticated RCE via scratchpad exec()

    MindsDB · Minds Platform

    Critical10.0
  • CVE-2026-71398

    Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)

    Adobe · Adobe Campaign Classic

    Critical10.0
  • CVE-2026-27302

    Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)

    Adobe · Adobe Campaign Classic

    Critical10.0
  • CVE-2026-58115

    A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed),…

    Siemens · SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2)

    Critical10.0
  • CVE-2026-27544

    WordPress QA Analytics plugin <= 5.2.0.0 - Remote Code Execution (RCE) vulnerability

    QuarkA · QA Analytics

    Critical10.0
  • CVE-2026-58231

    Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)

    SAP_SE · SAP Commerce Cloud (Data Hub Adapter)

    Critical10.0

Vendors with the most CVEs

  1. Linux1,215
  2. Microsoft409
  3. IBM160
  4. Red Hat99
  5. Adobe52
  6. Elastic48
  7. Gitea47
  8. siyuan-note46
  9. Apache Software Foundation40
  10. Dokploy35

Most common weaknesses

  1. CWE-862 Missing authorization188
  2. CWE-79 Cross-site scripting (XSS)170
  3. CWE-89 SQL injection126
  4. CWE-122 Heap-based buffer overflow121
  5. CWE-416 Use after free118
  6. CWE-125 Out-of-bounds read109
  7. CWE-22 Path traversal103
  8. CWE-863 Incorrect authorization100
  9. CWE-639 Authorization bypass through a user-controlled key (IDOR)95
  10. CWE-78 OS command injection91