CVEs published in August 2026

CVE-2026-13787High

CVE-2026-13786High

CVE-2026-13785High

CVE-2026-13784High

CVE-2026-13783High

CVE-2026-13782High

CVE-2026-13781High

CVE-2026-13780High

CVE-2026-13779High

CVE-2026-13778High

CVE-2026-13777High

CVE-2026-13776High

CVE-2026-13775High

CVE-2026-13774High

CVE-2026-0301Medium

PAN-OS: Information Disclosure Vulnerability in URL Filtering

CVE-2026-0299High

GlobalProtect App: Local Privilege Escalation Vulnerabilities

CVE-2026-0298High

GlobalProtect App: Code Execution Vulnerability in Windows Pre-Logon Access Provider (PLAP)

CVE-2026-0297High

GlobalProtect App: Buffer Overflow Vulnerability during UDP Tunnel Handshake

CVE-2026-0296High

GlobalProtect App: Improper Certificate Validation Bypass Vulnerability

CVE-2026-0295High

GlobalProtect App: Local Privilege Escalation via Race Condition on macOS

CVE-2026-0294High

Prisma Access Agent: Local Privilege Escalation

CVE-2026-0293High

Prisma Access Agent: Anti-Tamper Protection Bypass on Windows

CVE-2026-0292Medium

Prisma Access Agent: Local Security Inspection Bypass Vulnerability on Windows

CVE-2026-0291Medium

Prisma Access Agent: Authenticated Limited File Deletion on Linux

CVE-2026-0290High

CVE-2026-0289High

CVE-2026-59244Medium

Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI

CVE-2026-58076High

Apache Airflow: Unguarded import_string of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API Server

CVE-2026-59242Medium

Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint

CVE-2026-54183Medium

Apache Airflow: Airflow Variables were not masked in the UI for authenticated users

CVE-2026-67260High

Apache Airflow: DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserialization

CVE-2026-67587High

Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget

CVE-2026-65017Medium

Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass)

CVE-2026-68968High

Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id

CVE-2026-68969Medium

Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext

CVE-2026-68970Medium

Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI

CVE-2026-68971Medium

Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints

CVE-2026-68076Medium

Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection

CVE-2026-18171Medium

Docker Sandboxes (sbx) applies the read-only intent of a runtime host mount to the in-guest container bind only: the underlying virtio-fs host-edge grant is added to the sandbox's policy-share allowlist with no access mode

CVE-2026-68868Medium

Apache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables

CVE-2026-71408Medium

allocation of resources without limits or throttling vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4 all versions, FortiOS 7.2 all versions may allow attacker to denial of service via <insert attack vector here>

CVE-2026-71407Medium

Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6 may allow an unauthenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands in the context of the WAD daemon via crafted sockets, only if the explicit proxy is configured with Kerberos authentication and SOCKS enabled

CVE-2026-70468High

authentication bypass using an alternate path or channel vulnerability in Fortinet FortiManager 7.6.1, FortiManager 7.4.3 through 7.4.5, FortiManager 7.2.5 through 7.2.9, FortiManager Cloud 7.6.1, FortiManager Cloud 7.4.3 through 7.4.5, FortiManager Cloud 7.2.5 through 7.2.9 may allow attacker to improper access control via <insert attack vector here>

CVE-2026-70467Low

server-side request forgery (ssrf) vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM 7.4.0 through 7.4.2, FortiSIEM 7.3.0 through 7.3.5, FortiSIEM 7.2 all versions, FortiSIEM 7.1 all versions, FortiSIEM 7.0 all versions, FortiSIEM 6.7 all versions, FortiSIEM 6.6 all versions, FortiSIEM 6.5 all versions may allow attacker to execute unauthorized code or commands via <insert attack vector here>

CVE-2026-70466Medium

incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow attacker to improper access control via <insert attack vector here>

CVE-2026-70465High

Heap overflow in kernel driver due to missing size validation

CVE-2026-26035Critical

Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2.0 through 7.2.12, FortiWeb 7.0.0 through 7.0.12 may allow a remote unauthenticated attacker to login into the Fortiweb GUI/CLI with a random username and password

CVE-2026-29036High

Data corruption and unauthorized modification via JSON Pointer escape decoding

CVE-2026-71290Critical

Server impersonation via improper TLS hostname verification

CVE-2026-66150High

Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via SNMP

CVE-2026-66149High

Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via netmask

CVE-2026-18634Critical

insecure handling of serialized objects vulnerability was found in the one of the service of GMS application 9.5.1 (Build 9510.1044) and earlier versions

CVE-2026-66154Critical

insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 (Build 9510.1044) and earlier versions which, under a successful MitM attack and controlled network conditions, could permit unauthorized changes

CVE-2026-66148Critical

authenticated command injection vulnerability was identified in GMS Command-Line Interface (CLI) 9.5.1 (Build 9510.1044) and earlier versions which allows low-privileged local user to execute system commands with root privileges

CVE-2026-66147Critical

unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests

CVE-2026-66146Critical

Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) and earlier versions that allow a remote attacker to execute javascript script in a user's browser

CVE-2026-66145Critical

unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which allows remote attacker to read sensitive data and perform arbitrary file write via zipslip

CVE-2026-62917Medium

Microsoft SharePoint Server Spoofing Vulnerability

CVE-2026-62839Medium

Microsoft SharePoint Server Spoofing Vulnerability

CVE-2026-58639Medium

Microsoft SharePoint Server Spoofing Vulnerability

CVE-2026-62738Medium

Windows Management Instrumentation Information Disclosure Vulnerability

CVE-2026-71331High

Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability

CVE-2026-70326High

Microsoft SharePoint Server Elevation of Privilege Vulnerability

CVE-2026-70306Critical

Microsoft Office SharePoint Spoofing Vulnerability

CVE-2026-56179High

Windows Network Address Translation (NAT) Spoofing Vulnerability

CVE-2026-66802High

Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability

CVE-2026-65796High

Windows iSCSI Target Service Remote Code Execution Vulnerability

CVE-2026-65798Medium

Windows DNS Elevation of Privilege Vulnerability

CVE-2026-65799Medium

Windows DNS Elevation of Privilege Vulnerability

CVE-2026-65797Medium

Windows DNS Elevation of Privilege Vulnerability

CVE-2026-65794Medium

Windows SMB Client Information Disclosure Vulnerability

CVE-2026-65795Medium

Windows DNS Elevation of Privilege Vulnerability

CVE-2026-65791Critical

Windows iSCSI Target Service Remote Code Execution Vulnerability

CVE-2026-65790High

Windows Message Queuing Elevation of Privilege Vulnerability

CVE-2026-65777Medium

Active Directory Security Feature Bypass Vulnerability

CVE-2026-65776High

Windows Win32k Elevation of Privilege Vulnerability

CVE-2026-65775High

Windows Win32k Elevation of Privilege Vulnerability

CVE-2026-65774High

Windows Installer Elevation of Privilege Vulnerability

CVE-2026-65773High

Windows Kernel Elevation of Privilege Vulnerability

CVE-2026-65679High

Windows iSCSI Target Service Remote Code Execution Vulnerability

CVE-2026-65681High

Windows iSCSI Target Service Denial of Service Vulnerability

CVE-2026-64921High

Microsoft SharePoint Server Elevation of Privilege Vulnerability

CVE-2026-64916Medium

Microsoft SharePoint Server Spoofing Vulnerability

CVE-2026-64901High

Microsoft SharePoint Server Remote Code Execution Vulnerability

CVE-2026-64902Medium

Microsoft SharePoint Server Spoofing Vulnerability

CVE-2026-64900High

Microsoft SharePoint Server Spoofing Vulnerability

CVE-2026-64897Medium

Microsoft SharePoint Server Spoofing Vulnerability

CVE-2026-62911High

Microsoft Exchange Server Elevation of Privilege Vulnerability

CVE-2026-62888High

Windows DWM Core Library Elevation of Privilege Vulnerability

CVE-2026-62887Medium

Windows NTFS Information Disclosure Vulnerability

CVE-2026-62885High

Windows Win32k Elevation of Privilege Vulnerability

CVE-2026-62883Medium

Windows DNS Elevation of Privilege Vulnerability

CVE-2026-62881Medium

Windows DNS Elevation of Privilege Vulnerability

CVE-2026-62880High

Windows NTFS Elevation of Privilege Vulnerability

CVE-2026-62832High

Windows User Profile Service Elevation of Privilege Vulnerability

CVE-2026-62822High

Windows GDI+ Remote Code Execution Vulnerability

CVE-2026-62824High

Remote Desktop Client Remote Code Execution Vulnerability

CVE-2026-62823High

Windows DHCP Server Remote Code Execution Vulnerability

CVE-2026-62814Medium

Windows DHCP Server Information Disclosure Vulnerability

CVE-2026-62811High

Windows HTTP.sys Elevation of Privilege Vulnerability