Security Digest archive
August 2026
20 editorial briefs, 31 known exploited (cisa kev) additions and 71 critical advisories across 20 digest days.
Monday, August 31, 2026
- KEV CVE-2026-82078 PaperCut NG/MF
- KEV CVE-2026-81578 PaperCut NG/MF
Friday, August 28, 2026
- Act now JFrog Artifactory: Exploited Auth Bypass to Admin (KEV)
- Critical 10 advisories: github.com/free5gc/free5gc, plone.app.portlets, pimcore/pimcore, plone.app.event, github.com/klever-io/klever-go, github.com/klever-io/klever-go, org.yamcs:yamcs-core, pimcore/pimcore, org.yamcs:yamcs-core, org.yamcs:yamcs-core
Thursday, August 27, 2026
- Act now PaperCut NG/MF: Mass-Exploited Pre-Auth RCE Chain (KEV)
- Check exposure ownCloud CVE-2023-49105: 2023 WebDAV Bypass Now in KEV
- KEV CVE-2026-66384 JFrog Artifactory
- KEV CVE-2026-53362 Linux Kernel
- KEV CVE-2023-49105 ownCloud ownCloud
- Critical 1 advisory: litellm
Wednesday, August 26, 2026
- KEV CVE-2026-8452 Citrix NetScaler ADC and NetScaler Gateway
- KEV CVE-2022-0995 Linux Kernel
- KEV CVE-2021-23758 Ajax.NET Professional Ajax.NET Professional
- KEV CVE-2019-1068 Microsoft SQL Server
- KEV CVE-2015-5287 Red Hat Automatic Bug Reporting Tool
- KEV CVE-2015-3246 Red Hat Libuser
- Critical 6 advisories: org.springframework:spring-webmvc, senaite.core, org.springframework:spring-webflux, org.springframework:spring-webflux, pantheon-agents, github.com/kyverno/kyverno
Tuesday, August 25, 2026
- Patch this week Next.js: Windows, AVIF and next/og RCEs (Aug-Sep 2026)
- Patch this week Apache Tomcat August 2026: Security Constraint Bypasses
- KEV CVE-2026-60004 Gitea Gitea
- Critical 9 advisories: chainlit, qwed-mcp, org.apache.tomcat:tomcat, grpc, org.apache.tomcat:tomcat, org.apache.tomcat:tomcat, nextcloud-mcp-server, ash_authentication, PraisonAI
Monday, August 24, 2026
- KEV CVE-2026-21962 Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in
- Critical 4 advisories: mcp-contextforge-gateway, org.apache.camel:camel-undertow, org.apache.camel:camel-atmosphere-webso…, org.apache.camel:camel-azure-storage-bl…
Friday, August 21, 2026
- KEV CVE-2026-73570 Synacor Zimbra Collaboration Suite (ZCS)
- Critical 6 advisories: xinference, org.geotools.jdbc:gt-jdbc-postgis, phalcon/cphalcon, jsonata, jsonata, jsonata
Thursday, August 20, 2026
- Check exposure Spring for GraphQL CVE-2026-59285: Pagination RCE Risk
- Check exposure arrayref, internment, append-only-vec: Rust Crates Hijacked
- KEV CVE-2026-72530 TrueConf Server
- KEV CVE-2026-72529 TrueConf Server
- Critical 2 advisories: @whyour/qinglong, github.com/dgraph-io/dgraph/v25
Wednesday, August 19, 2026
- Act now NetScaler CVE-2026-19490: Exploited Gateway Auth Bypass
- KEV CVE-2026-64849 MLflow MLflow
Tuesday, August 18, 2026
- KEV CVE-2026-65400 Apple macOS
- KEV CVE-2026-59310 Broadcom VMware vCenter
- KEV CVE-2026-55040 Microsoft SharePoint
- KEV CVE-2026-33824 Microsoft Internet Key Exchange (IKE) Service Extensions
- Critical 6 advisories: surfio, resdata, mtdowling/jmespath.php, kobako, froxlor/froxlor, org.keycloak:keycloak-services
Monday, August 17, 2026
- Check exposure vm2: 22 Critical Sandbox Escapes, Fixed in 3.12.2
- KEV CVE-2025-62593 Ray-Project Ray
- Critical 7 advisories: vm2, vm2, vm2, github.com/QuantumNous/new-api, mlflow, github.com/QuantumNous/new-api, wktk/conflibot
Tuesday, August 11, 2026
- Act now Adobe Commerce CVE-2026-71362: Exploited Account Takeover
- Patch this week Cisco ASA/FTD CVE-2026-20349: Exploited VPN Crash Bug
- Patch this week Windows AFD.sys CVE-2026-68820: Exploited Zero-Day EoP
- KEV CVE-2026-72898 Metabase Metabase
- KEV CVE-2026-68820 Microsoft Windows Ancillary Function Driver for WinSock
- KEV CVE-2026-20349 Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)
- Critical 1 advisory: github.com/seaweedfs/seaweedfs
Monday, August 10, 2026
- Critical 1 advisory: org.apache.ranger:ranger
Friday, August 7, 2026
- KEV CVE-2026-8037 Progress LoadMaster
- Critical 4 advisories: craftcms/cms, crypto-js, codeigniter4/framework, codeigniter4/framework
Thursday, August 6, 2026
- Act now Metabase CVE-2026-72898: Exploited Pre-Auth SQL Injection
- Check exposure macOS Screen Sharing CVE-2026-65400: Exploited Auth Bypass
- Critical 1 advisory: github.com/traefik/traefik/v2
Wednesday, August 5, 2026
- Check exposure Gemini CLI and Claude Code Flaws Expose CI Secrets
- KEV CVE-2026-63077 JetBrains TeamCity
- Critical 1 advisory: @nuxt/devtools
Tuesday, August 4, 2026
- Act now Langflow CVE-2026-9198: Exploited Unauthenticated RCE
- Check exposure ChainDrop: npm Worm Trojanizes keyv and cacheable Packages
- Check exposure Open VSX: 77 Evil-Twin Extensions Leak Developer Data
- KEV CVE-2026-9198 IBM Langflow
- KEV CVE-2026-34486 Apache Tomcat
- KEV CVE-2026-18556 N-able N-central
- Critical 10 advisories: flowise-components, flowise, flowise, flowise, flowise, flowise, flowise, flowise, flowise, flowise
Monday, August 3, 2026
- KEV CVE-2026-18577 N-able N-central
- Critical 1 advisory: sequelize
Sunday, August 2, 2026
- Act now MLflow CVE-2026-64849: Exploited Unauthenticated SSRF
- Critical 1 advisory: org.bouncycastle:bc-fips
Saturday, August 1, 2026