CVEs published in August 2026

CVE-2026-33750Critical

CVE-2026-33672Critical

CVE-2026-33532Critical

CVE-2026-28277Critical

CVE-2026-2739Critical

CVE-2026-27199Critical

CVE-2026-25674Critical

CVE-2026-24133Critical

CVE-2026-24043Critical

CVE-2026-22815Critical

CVE-2026-22702Critical

CVE-2026-21860Critical

CVE-2026-0540Critical

CVE-2025-67726Critical

CVE-2025-67725Critical

CVE-2025-67724Critical

CVE-2025-66221Critical

CVE-2025-6547Critical

CVE-2025-6545Critical

CVE-2025-15599Critical

CVE-2025-13473Critical

CVE-2024-35255Critical

CVE-2026-21584High

Confluence: This High severity Improper Authorization vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center

CVE-2026-21582High

Confluence: This High severity BASM (Broken Authentication & Session Management) vulnerability known as CVE-2026-21582 was introduced in version 7.2.1 of Crowd Data Center

CVE-2026-21580Critical

This Critical severity Stored XSS, PrivEsc (Privilege Escalation), and Security Misconfiguration vulnerability was introduced in versions 7.1.1, 7.4.0, 7.13.0, 7.17.0, 7.19.0, 8.0.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center and Server

CVE-2026-71084Medium

Denial of Service via unauthenticated local access

CVE-2026-71079Medium

Denial of Service via network access by a low privileged attacker

CVE-2026-76047High

Arbitrary code execution via type confusion in V8

CVE-2026-76038High

Remote code execution via type confusion in crafted HTML.

CVE-2026-15571High

Predictable account-linking hash enables account takeover via malicious OIDC client

CVE-2026-17106High

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory

CVE-2026-18963Critical

Unauthenticated account takeover via reset-credentials flow bypass

CVE-2026-75838Critical

Cross-Site Scripting via IN_PLACE sanitization

CVE-2026-70907Medium

Enhance TLS server (2026-08 Security Update)

CVE-2026-70906High

Improve font loading (2026-08 Security Update)

CVE-2026-61308Medium

Enhance HTTP Connections (2026-08 Security Update)

CVE-2026-60589Medium

Improve Resource Resolving (2026-08 Security Update)

CVE-2026-34884Critical

SSRF via set_skywalking_url Tool and GraphQL expression injection vulnerability in Apache SkyWalking MCP

CVE-2026-19650High

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request validation in GraphQL multiplex query handling

CVE-2026-19478Critical

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive

CVE-2026-59903High

Information disclosure via CORS Vary header overwrite

CVE-2026-73646High

Path Traversal (Arbitrary Read/Write) postcss Dependency in Confluence Data Center

CVE-2026-19693High

File Inclusion extract-zip Dependency in Confluence Data Center

CVE-2026-73632Medium

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts

CVE-2026-73631Medium

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts

CVE-2026-73635High

DoS (Denial of Service) org.apache.struts:struts2-core Dependency in Crowd Data Center

CVE-2026-73634High

Uncontrolled resource consumption vulnerability in Apache Struts

CVE-2026-72493Critical

serialize netif_running check in enqueue_to_backlog

CVE-2026-73633High

Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts

CVE-2026-58088High

FreeBSD Vulnerability in NetApp Products

CVE-2026-58087High

FreeBSD Vulnerability in NetApp Products

CVE-2026-58086High

FreeBSD Vulnerability in NetApp Products

CVE-2026-58085High

FreeBSD Vulnerability in NetApp Products

CVE-2026-58084Medium

FreeBSD Vulnerability in NetApp Products

CVE-2026-58083High

FreeBSD Vulnerability in NetApp Products

CVE-2026-54876High

OpenSSL Vulnerability in NetApp Products

CVE-2026-45205Critical

IBM Db2 Vulnerability in NetApp Products

CVE-2026-31589Critical

Linux Kernel Vulnerability in NetApp Products

CVE-2026-18097Medium

IBM Db2 Vulnerability in NetApp Products

CVE-2026-18096Low

IBM Db2 Vulnerability in NetApp Products

CVE-2026-16480Medium

IBM Db2 Vulnerability in NetApp Products

CVE-2026-10543High

IBM Db2 Vulnerability in NetApp Products

CVE-2026-10534High

IBM Db2 Vulnerability in NetApp Products

CVE-2025-22850High

CVE-2025-22444High

CVE-2025-20105High

CVE-2025-20073High

CVE-2025-20068High

CVE-2025-20064High

CVE-2025-20028High

CVE-2025-20027High

CVE-2025-20005High

CVE-2026-72647Medium

Denial of Service via uncontrolled recursion in search requests

CVE-2026-72656Medium

Denial of Service via excessive memory allocation in ES|QL queries

CVE-2026-72678Medium

Denial of Service via excessive memory allocation

CVE-2026-73566High

DoS (Denial of Service) tar Dependency in Confluence Data Center

CVE-2026-73508High

DoS (Denial of Service) io.netty:netty-codec-dns Dependency in Bitbucket Data Center

CVE-2026-73507High

DoS (Denial of Service) io.netty:netty-codec Dependency in Bitbucket Data Center

CVE-2026-66256High

** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Shindig

CVE-2026-6471High

PostgreSQL Vulnerability in NetApp Products

CVE-2025-9486Low

GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed a user with a pending membership to receive permissions granted by a custom role, due to incorrect privilege assignment that did not account for membership state

CVE-2026-4879Medium

GitLab has remediated an issue in GitLab EE affecting all versions from 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to view external status check configuration restricted to higher-privileged roles due to missing authorization on a merge request API endpoint

CVE-2026-6821Medium

GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to bypass IP-based access restrictions and read limited merge request information from a private project due to missing authorization checks in a merge requests API endpoint

CVE-2026-15217High

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled values rendered in table cell content by an analytics dashboard component

CVE-2026-15216High

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled data rendered in pagination controls by an analytics dashboard component

CVE-2026-16494High

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to modify project settings restricted to higher-privileged roles, due to missing authorization checks on a project update endpoint

CVE-2026-18433Medium

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to read policy configuration belonging to a namespace they were not authorized to access, due to incorrect authorization checks in a GraphQL query

CVE-2026-19228High

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to cause AI usage to be attributed to another namespace, due to improper authorization of identity information supplied in requests

CVE-2026-7427Medium

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to improper input validation

CVE-2026-8667Medium

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer role to modify certain package registry metadata without the required maintainer-level permissions due to improper authorization checks

CVE-2026-15423High

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without the required push permissions due to improper authorization in pipeline reference validation

CVE-2026-16627High

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal

CVE-2026-18244Medium

GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to view restricted configuration settings due to improper authorization checks on a group settings page

CVE-2026-73237Medium

XSS vulnerability in Markdown handling in Apache Allura

CVE-2026-73238Medium

XSS vulnerability in code display in Apache Allura

CVE-2026-73239Medium

Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura

CVE-2026-73240Critical

Specifically crafted inputs may lead to git argument injection in Apache Allura

CVE-2026-20359Critical

CVE-2026-20358Critical

CVE-2026-20357Critical