CVEs published in August 2026
1,356 tracked CVEs from 28 vendors had their first vendor advisory published in August 2026: 189 critical, 821 high, 11 in CISA KEV. Newest first.
2,700 more from this month are covered only by Red Hat's per-package records, listed on the Red Hat vendor page.
- Added
CVE-2026-48834High
Improper Handling of Length Parameter Inconsistency vulnerability in Apache Answer
Apache · 1 advisory - Added
CVE-2026-0516Medium
SonicOS: improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS could allow a remote attacker to manipu…
SonicWall · 1 advisory - Added
CVE-2026-61486Critical
Apache Lucy: stack-buffer-overflow in JSON parser error reporter on malformed input
Apache · 1 advisory - Added
CVE-2026-61485High
** UNSUPPORTED WHEN ASSIGNED ** Memory Allocation with Excessive Size Value vulnerability in Apache Lucy
Apache · 1 advisory - Added
CVE-2026-61484Critical
Apache Lucy: LucyX::Remote::SearchServer unauthenticated remote Storable::thaw -> RCE/DoS
Apache · 1 advisory - Added
CVE-2026-61483High
Apache Lucy: QueryParser unbounded recursion on deeply-nested query -> C-stack-overflow DoS
Apache · 1 advisory - Added
CVE-2026-68080Medium
Apache Qpid Broker-J: It was not possible to govern the rate at which the broker would respond to an echo flow, enabling an authenticated attacker to cause excessive resource usage and potential denial of service
Apache · 1 advisory - Added
CVE-2026-67592High
Denial of Service via uncontrolled incoming data transfers
Apache, Red Hat · 2 advisories - Added
CVE-2026-67555Medium
It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service This issue affects Apache Qpid Proton-Dotnet: through 1.0.0
Apache · 1 advisory - Added
CVE-2026-68078Medium
Apache Qpid Broker-J: It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service
Apache · 1 advisory - Added
CVE-2026-66277Medium
Denial of Service via uncontrolled transfer frames
Apache, Red Hat · 2 advisories - Added
CVE-2026-67554Medium
Apache Qpid Proton-Dotnet: authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service
Apache · 1 advisory - Added
CVE-2026-68077Medium
Apache Qpid Broker-J: authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service
Apache · 1 advisory - Added
CVE-2026-66276Medium
Denial of service via unbounded disposition range handling
Apache, Red Hat · 2 advisories - Added
CVE-2026-67591Medium
Denial of Service via exceeding session flow control window
Apache, Red Hat · 2 advisories - Added
CVE-2026-67553Medium
Apache Qpid Proton-Dotnet: authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service
Apache · 1 advisory - Added
CVE-2026-68075Medium
Apache Qpid Broker-J: authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service
Apache · 1 advisory - Added
CVE-2026-66275Medium
Denial of Service via exceeding session flow control window
Apache, Red Hat · 2 advisories - Added
CVE-2026-67590High
Apache Qpid ProtonJ2: pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service
Apache · 1 advisory - Added
CVE-2026-67552High
Apache Qpid Proton-Dotnet: pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service
Apache · 1 advisory - Added
CVE-2026-68073High
Apache Qpid Broker-J: pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service
Apache · 1 advisory - Added
CVE-2026-66274High
Denial of Service via unbounded type nesting
Apache, Red Hat · 2 advisories - Added
CVE-2026-67589High
Denial of Service via excessive memory allocation
Apache, Red Hat · 2 advisories - Added
CVE-2026-67551High
Apache Qpid Proton-Dotnet: pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service
Apache · 1 advisory - Added
CVE-2026-68060High
Apache Qpid Broker-J: pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service
Apache · 1 advisory - Added
CVE-2026-66273High
Denial of Service due to excessive allocation
Apache, Red Hat · 2 advisories - Added
CVE-2026-67588High
Denial of Service via unbounded symbol value caching
Apache, Red Hat · 2 advisories - Added
CVE-2026-67465High
Apache Qpid Proton-Dotnet: pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service
Apache · 1 advisory - Added
CVE-2026-68074High
Apache Qpid Broker-J: pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service
Apache · 1 advisory - Added
CVE-2026-66257High
Denial of Service via unbounded symbol value caching
Apache, Red Hat · 2 advisories - Added
CVE-2026-63456Critical
Authentication bypass via spoofed HTTP headers Orchestrator REST API
Aruba · 1 advisory - Added
CVE-2026-63455Critical
Authentication bypass via spoofed HTTP headers Orchestrator REST API
Aruba · 1 advisory - Added
CVE-2026-56848High
Heap-use-after-free in HTTP/2 handling can lead to denial of service
NetApp, Red Hat · 2 advisories - Added
CVE-2026-68494High
DoS (Denial of Service) com.fasterxml.jackson.core:jackson-core, tools.jackson.core:jackson-core Dependency in Jira Software Data Center
Atlassian, NetApp, Red Hat · 3 advisories - Added
CVE-2026-18401Medium
Denial of Service due to number length bypass in asynchronous JSON parser
NetApp, Red Hat · 2 advisories - Added
CVE-2026-14818High
path traversal vulnerability in the CLI command used to execute configuration files in Zyxel ATP series firmware versions from V4.32 through V5.42 Patch 1, USG FLEX series firmware versions from V4.50 through V5.42 Patch 1, USG FLEX 50(W) series firmware versions from V4.16 through V5.42 Patch 1, and USG20(W)-VPN series firmware versions from V4.16 through V5.42 Patch 1 could allow an authenticated attacker with administrator privileges to execute a crafted malicious configuration file on an affected device
Zyxel · 1 advisory - Added
CVE-2026-8508Medium
improper authentication vulnerability in the "social_login.cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an attacker on the WLAN to bypass captive portal authentication
Zyxel · 1 advisory - Added
CVE-2026-6837High
post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device
Zyxel · 1 advisory - Added
CVE-2026-58041Medium
Node.js node:sqlite: Unintended data modification due to stale statement iterator
NetApp, Red Hat · 2 advisories - Added
CVE-2026-65641Critical
Vulnerability Resolved in Veeam ONE 13.1 Patch 0
Veeam · 2 advisories - Added
CVE-2026-107671High
Vulnerabilities Resolved in Veeam ONE 13.1 Patch 1
Veeam · 2 advisories - Added
CVE-2026-68981High
Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter
Apache · 1 advisory - Added
Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API
Apache · 1 advisory - Added
CVE-2026-62354High
Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values
Apache · 1 advisory - Added
CVE-2026-68979Medium
Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values
Apache · 1 advisory - Added
CVE-2026-69152Critical
DoS (Denial of Service) brace-expansion Dependency in Jira Software Data Center
Atlassian, Red Hat, Splunk · 3 advisories - Added
CVE-2026-61372High
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Jena Fuseki
Apache · 1 advisory - Added
CVE-2026-18477Medium
TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape
NetApp, Red Hat · 2 advisories - Added
CVE-2026-18574Critical
authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) could allow an unauthenticated remote attacker with network access to Management services to execute arbitrary commands on the Security Management Server
Check Point · 1 advisory - Added
CVE-2026-4793High
incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files and conduct denial-of-service during installation
Synology · 1 advisory - Added
CVE-2026-58062Critical
Cryptographic Failure org.bouncycastle:bcprov-lts8on Dependency in Confluence Data Center
Atlassian, Red Hat · 2 advisories - Added
CVE-2026-59650Critical
Injection Bouncy Castle Dependency in Confluence Data Center
Atlassian, Red Hat · 2 advisories - Added
CVE-2026-8763Critical
Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI
Atlassian, Red Hat · 2 advisories - Added
CVE-2026-18577HighCISA KEV
N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
N-able · 1 advisory - Added
CVE-2026-18556HighCISA KEV
N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
N-able · 2 advisories - Added
CVE-2026-67320High
Information disclosure via Prototype Pollution in Node HTTP adapter
Atlassian, Red Hat · 2 advisories