Week 34, 2026

17 August to 23 August 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.

CVEs published: 3,421
Critical: 559
High: 1,572
Added to KEV: 9

Critical 559High 1,572Medium 1,109Low 130Not scored 51All 3,421 in the list

Added to KEVAttackers use these now; patch them first

CVE-2026-73570
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP…
Zimbra · Collaboration
ExploitedHigh8.9
CVE-2026-72530
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and…
TrueConf · TrueConf Server
ExploitedCritical9.5
CVE-2026-72529
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and…
TrueConf · TrueConf Server
ExploitedCritical9.3
CVE-2026-64849
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
mlflow · mlflow
ExploitedCritical9.3
CVE-2026-65400
An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9,…
Apple · macOS
ExploitedCritical9.8
CVE-2026-59310
vCenter directory-traversal vulnerability
VMware · Cloud Foundation
ExploitedCritical9.8
CVE-2026-33824
Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability
Microsoft · Windows 10 Version 1607
ExploitedCritical9.8
CVE-2026-55040
Microsoft SharePoint Server Security Feature Bypass Vulnerability
Microsoft · Microsoft SharePoint Enterprise Server 2016
ExploitedCritical9.1
CVE-2025-62593
Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack
ray-project · ray
ExploitedCritical9.4

Most severe new CVEsBy CVSS score

CVE-2026-18051
W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key
Unknown · W3 Total Cache
Critical10.0
CVE-2026-69836
Microsoft Entra ID Remote Code Execution Vulnerability
Microsoft · Microsoft Entra
Critical10.0
CVE-2026-19977
EFM ipTIME A3004T Session Validation httpcon_check_session_url improper authentication
EFM · ipTIME A3004T
Critical10.0
CVE-2026-61539
Xinference: Remote code execution via unsafe `eval()` in Llama3 tool-call parsing
xorbitsai · inference
Critical10.0
CVE-2026-75784
TRENDnet TEW-WLC100 HTTP Header nginx FUN_0040da4c stack-based overflow
TRENDnet · TEW-WLC100
Critical10.0
CVE-2026-65770
Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability
Microsoft · Azure Managed Instance for Apache Cassandra
Critical10.0
CVE-2026-74843
Wavlink WN531P3/WN535M1 Export Pingortrace CGI export_pingortrace.cgi strcpy stack-based overflow
Wavlink · WN531P3
Critical10.0
CVE-2026-77946
TRENDnet TEW-821DAP NTP Timezone Configuration apply_time.cgi uci_safe_get stack-based overflow
TRENDnet · TEW-821DAP
Critical10.0
CVE-2026-76008
Comfast CF-N1-S URI Parameter Parsing mbox-config get_para_from_uri stack-based overflow
Comfast · CF-N1-S
Critical10.0
CVE-2026-65816
Azure Arc Elevation of Privilege Vulnerability
Microsoft · Azure Web Apps
Critical10.0

Week 34, 2026

Added to KEVAttackers use these now; patch them first

Most severe new CVEsBy CVSS score

Vendors with the most CVEs

Most common weaknesses