Week 36, 2026

31 August to 6 September 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.

CVEs published: 2,285
Critical: 313
High: 819
Added to KEV: 10

Critical 313High 819Medium 910Low 74Not scored 169All 2,285 in the list

Added to KEVAttackers use these now; patch them first

CVE-2026-85046
Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.…
Google · Chrome
ExploitedHigh8.8
CVE-2026-83548
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote…
SonicWall · SMA1000
ExploitedCritical10.0
CVE-2026-49869
Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`
kestra-io · kestra
ExploitedCritical10.0
CVE-2026-82329
Potential authentication bypass leading to administrative access in Artifactory
jfrog · artifactory
ExploitedCritical9.8
CVE-2026-9586
Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB
Sangoma · Switchvox SMB Edition
ExploitedCritical9.3
CVE-2026-59822
LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
BerriAI · litellm
ExploitedHigh8.8
CVE-2026-83549
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000…
SonicWall · SMA1000
ExploitedHigh7.8
CVE-2026-48710
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
Kludex · starlette
ExploitedMedium6.5
CVE-2026-82078
PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector
PaperCut · PaperCut MF/NG
ExploitedCritical9.4
CVE-2026-81578
PaperCut MF/NG: Authentication Bypass
PaperCut · PaperCut MF/NG
ExploitedHigh8.8

Most severe new CVEsBy CVSS score

CVE-2026-86218
pre-authentication remote code execution
N-able · N-central
ExploitedCritical10.0
CVE-2026-83548
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote…
SonicWall · SMA1000
ExploitedCritical10.0
CVE-2026-82971
QVidium Opera11 CGI Script net_tr.cgi command injection
QVidium · Opera11
Critical10.0
CVE-2026-86152
Tenda CP3 Kylin AutoAddWifi.cpp ThreadProc os command injection
Tenda · CP3
Critical10.0
CVE-2026-82694
Tenda AC1206 Web UI ate R7WebsSecurityHandler missing authentication
Tenda · AC1206
Critical10.0
CVE-2026-82693
Tenda AC1206 Web UI telnet TendaTelnet missing authentication
Tenda · AC1206
Critical10.0
CVE-2026-82695
Tenda AC18 Telnet telnet missing authentication
Tenda · AC18
Critical10.0
CVE-2026-84147
Remote Code Execution Vulnerability in Manacle Technologies ERP System
Manacle Technologies · Multi-tenant ERP System
Critical10.0
CVE-2026-70352
Azure AI Language Elevation of Privilege Vulnerability
Microsoft · Azure AI Language Authoring
Critical10.0
CVE-2026-83711
Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability
Microsoft · Entra
Critical10.0

Week 36, 2026

Added to KEVAttackers use these now; patch them first

Most severe new CVEsBy CVSS score

Vendors with the most CVEs

Most common weaknesses