CVEs published in August 2026

CVE-2024-40714Unrated

CVE-2024-40713Unrated

CVE-2024-40712Unrated

CVE-2024-40711UnratedCISA KEV

Veeam Backup and Replication Deserialization Vulnerability

CVE-2024-40710Unrated

CVE-2024-40709Unrated

CVE-2024-39718Unrated

CVE-2024-29853Unrated

CVE-2024-29852Unrated

CVE-2024-29851Unrated

CVE-2024-29850Unrated

CVE-2024-29849Unrated

CVE-2023-27532UnratedCISA KEV

Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability

CVE-2022-26504Unrated

CVE-2022-26503Unrated

CVE-2022-26501UnratedCISA KEV

Veeam Backup & Replication Remote Code Execution Vulnerability

CVE-2022-26500UnratedCISA KEV

Veeam Backup & Replication Remote Code Execution Vulnerability

CVE-2021-35971Unrated

CVE-2026-75099Medium

Unauthenticated REST disclosure of certain content items in Apache Allura

CVE-2026-78329Critical

CVE-2026-71300Critical

CVE-2026-63621High

Header injection vulnerability allows server-side request forgery

CVE-2026-66908High

org.apache.camel/camel-platform-http-main: org.apache.camel/camel-main: Apache Camel: Improper authentication allows JWT bypass in Platform HTTP Main component

CVE-2026-66907High

Relative path traversal vulnerability in Apache Camel Google Storage component

CVE-2026-66906Critical

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component

CVE-2026-60093Medium

Relative path traversal vulnerability in Apache Camel Azure-Storage Datalake component This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0

CVE-2026-59230Medium

Improper input validation vulnerability in Apache Camel

CVE-2026-76172High

URI parsing flaw enables server-side request forgery and redirects

CVE-2026-75975High

Server-side request forgery via malformed IPv6 normalization

CVE-2026-75899High

Server-Side Request Forgery via repeated hostname percent-decoding

CVE-2026-10053High

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to achieve remote code execution due to a path traversal vulnerability in the package registry

CVE-2026-62243High

TLS hostname verification bypass via OpenSSL client path misconfiguration

CVE-2026-59654Medium

Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality

CVE-2026-59323Medium

Spring Boot: application using Micrometer Tracing with W3C baggage propagation in the Brave bridge is vulnerable to denial of s…

CVE-2026-47827High

BOSH: Command Injection in BOSH CLI tool on windows in Cloud Foundry allows a remote attacker to execute arbitrary shell co…

CVE-2026-63046High

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache InLong

CVE-2026-47359High

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache CloudStack's NAS backup provider plugin

CVE-2026-50112High

Apache CloudStack: SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets

CVE-2026-50222High

Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs

CVE-2026-59085Critical

Server-Side Request Forgery (SSRF) vulnerability in Apache CloudStack's webhook module, exploitable via webhook delivery requests

CVE-2026-59655High

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth authentication plugin while listing OAuth providers

CVE-2026-59657High

Cleartext Storage of Sensitive Information vulnerability in Apache CloudStack with AsyncJob storage in the database

CVE-2026-59780High

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's LDAP authentication plugin while listing LDAP providers

CVE-2026-59799High

Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authentication disable flow

CVE-2026-61397High

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration

CVE-2026-61398Critical

Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Instance Reset Password functionality

CVE-2026-61399Medium

Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Lock User Functionality

CVE-2026-61400High

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache CloudStack's run and get diagnostics functionality for the system VMs and virtual routers

CVE-2026-61422Medium

Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality

CVE-2026-62440Critical

Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service (CKS) plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes

CVE-2026-65613Medium

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries

CVE-2026-66721Low

Apache CloudStack: Missing authorization issue for domain admins in CloudStack's host tags listing functionality

CVE-2026-66722High

Apache CloudStack: Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack

CVE-2026-68745High

Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow a malicious agent to forge a SAML response to the management server

CVE-2026-71073Medium

CVE-2026-1245Medium

Node.js Vulnerability in NetApp Products

CVE-2026-69519High

Azure Stack HCI Information Disclosure Vulnerability

CVE-2026-65801Critical

Microsoft Exchange Online Elevation of Privilege Vulnerability

CVE-2026-76020High

Race condition in V8

CVE-2026-63044Medium

Server-Side Request Forgery (SSRF) vulnerability in Apache InLong

CVE-2026-75140High

DoS (Denial of Service) org.jsoup:jsoup Dependency in Bamboo Data Center

CVE-2026-63043High

Relative Path Traversal vulnerability in Apache InLong

CVE-2026-63042High

Files or Directories Accessible to External Parties vulnerability in Apache InLong

CVE-2026-63040High

Files or Directories Accessible to External Parties vulnerability in Apache InLong

CVE-2026-63039Critical

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong

CVE-2026-63038Critical

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong

CVE-2026-63037Critical

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong

CVE-2026-63016Medium

Uncontrolled Resource Consumption vulnerability in Apache InLong

CVE-2026-63015Medium

Uncontrolled Resource Consumption vulnerability in Apache InLong

CVE-2026-76957Medium

Memory corruption vulnerability allows arbitrary code execution or denial of service

CVE-2026-76405Medium

In Splunk On-Call (VictorOps) app versions below 1.0.43 on Splunkbase, a user who does not hold the "admin" or "power" Splunk roles could read a partially masked Application Programming Interface (API) key from the App Key Value Store (KV Store)

CVE-2026-76404Critical

In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system

CVE-2026-76403High

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user positioned in the network path could read or alter all relevant data sent from the connector when Kerberos authentication is used with Hypertext Transfer Protocol (HTTP) Event Collector in Splunk Enterprise

CVE-2026-76402High

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer (REST) API could configure a non-secure Hypertext Transfer Protocol (HTTP) Event Collector endpoint in Splunk Enterprise that causes the connector to send authentication credentials to an attacker-controlled server, allowing for exposure of credentials that compromise all relevant data sent through the connector and limited alteration of event delivery

CVE-2026-76401Medium

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer (REST) API could configure timestamp extraction with a crafted regular expression and matching event data to block a Kafka Connect worker thread, stopping event delivery for the affected connector

CVE-2026-76400Medium

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer (REST) API and influence responses from a Hypertext Transfer Protocol (HTTP) Event Collector endpoint in Splunk Enterprise could cause the connector to retry failed event batches until event delivery stops

CVE-2026-76399High

Incorrect Permission Assignment for Scheduled Searches in Splunk AI Toolkit

CVE-2026-76398Medium

Improper Access Control during Experiment History Deletion through the REST API in Splunk AI Toolkit

CVE-2026-76397High

Improper Access Control in Experiment History through the REST API in Splunk AI Toolkit

CVE-2026-76396High

Improper Access Control through Scheduled Searches in Splunk AI Toolkit

CVE-2026-76395High

Remote Code Execution (RCE) through Deserialization of Untrusted Data in the Model Loading REST API in Splunk AI Toolkit

CVE-2026-76394High

Missing Authorization in Container and Connection Management through the REST API in Splunk AI Toolkit

CVE-2026-76393Medium

Race Condition during Model Upload through the REST API in Splunk AI Toolkit

CVE-2026-76392Medium

Use of Hard-coded Credentials in Container Connections in Splunk AI Toolkit

CVE-2026-76391High

Improper Privilege Management through Agent Run History in Splunk AI Toolkit

CVE-2026-76390Medium

Information Disclosure through Splunk Web in Cisco Talos Intelligence for Enterprise Security Cloud

CVE-2026-76389High

Server-Side Request Forgery (SSRF) through the REST API in Cisco Talos Intelligence for Enterprise Security Cloud

CVE-2026-76388High

Privilege Escalation through Search Macro Permissions in Splunk Enterprise Security

CVE-2026-76387High

SPL Injection through the REST API in Splunk Enterprise Security

CVE-2026-76386Medium

Information Disclosure through Action Parameters in Zoom app for Splunk SOAR

CVE-2026-76385Medium

Information Disclosure through Action Parameters in Venafi app for Splunk SOAR

CVE-2026-76384Medium

Information Disclosure through Action Parameters in Splunk Attack Analyzer Connector for Splunk SOAR

CVE-2026-76383Medium

Information Disclosure through Action Parameters in RSA SecurID Authentication Manager app for Splunk SOAR

CVE-2026-76382Medium

Information Disclosure through Action Parameters in Phantom app for Splunk SOAR

CVE-2026-76381Medium

Information Disclosure through Action Parameters in MS Graph for Active Directory app for Splunk SOAR

CVE-2026-76380Medium

Information Disclosure through Action Parameters in CrowdStrike OAuth API app for Splunk SOAR

CVE-2026-76379Medium

Information Disclosure through Action Parameters in Cisco Webex app for Splunk SOAR

CVE-2026-76378Medium

Information Disclosure through Action Parameters in Cisco Secure Malware Analytics app for Splunk SOAR

CVE-2026-76377Medium

Information Disclosure through Action Parameters in Azure AD Graph app for Splunk SOAR

CVE-2026-76376Medium

Information Disclosure through Action Parameters in AWS IAM app for Splunk SOAR